cert_validate check 1

Notes

• 2026-08-18: ADM-division SOW lines (ADM-RUSH, ADM-MISS) are now exempt from check 1 “All SOW Lines inspected” (entirely-api d9e5472). They are billing items, not inspectable scope — the cert generator already excludes them from scope_lines via the CERT_DIVISIONS filter, but check 1 blocked certification when they sat uninspected (MAN-9179 blocked solely by its ADM-RUSH line; 22 of 26 ADM lines carry inspected=None). Division resolves via the linked product (_product_id_to_division) with the title’s product code as fallback; check detail strings note exempted count. Verified live: MAN-9168 (uninspected ADM-RUSH) now passes check 1, MAN-9179 passes, MAN-9014 (3 uninspected non-ADM lines) still fails. Deployed to unlikely-api via docker cp + restart (rebuild avoided — parallel session had uncommitted edits in the main tree); worker/scheduler pick it up at next rebuild.