fix(confidence-engine): unwrap overview provider response

Production: synthesizeInvestigationOverview() now passes providerResult.response
to validateOverviewResponse() instead of the raw envelope, matching the proven
pattern in current-understanding-synthesis.js.

Regression: fakeProvider returns real-provider envelope shape { response, providerApiPath }
and four new regression tests verify unwrapping succeeds with valid response
and fails correctly with invalid response inside the envelope.

Handoff: documented defect confirmed, fix applied, and owning regression added.

lib/graph/investigation-overview-synthesis.js

@@ -240,9 +240,9 @@ export async function synthesizeInvestigationOverview(params, deps) {
   // Build overview-specific prompt (keeps evidence/interpretation separate)
   const prompt = buildOverviewSynthesisPrompt(situationGraph, findings, plausibleInterpretations);
 
-  let rawResponse;
+  let providerResult;
   try {
-    rawResponse = await provider.generateReconstruction(
+    providerResult = await provider.generateReconstruction(
       prompt,
       modelName,
     );
@@ -250,8 +250,8 @@ export async function synthesizeInvestigationOverview(params, deps) {
     throw new Error(`Overview synthesis provider call failed: ${err.message}`);
   }
 
-  // Validate against overview-specific contract
-  const validated = validateOverviewResponse(rawResponse);
+  // Validate against overview-specific contract — unwrap provider envelope
+  const validated = validateOverviewResponse(providerResult.response);
   if (!validated.valid) {
     throw new Error(`Overview synthesis validation failed: ${validated.reason}`);
   }