FamilyGraph: Pick<Graph, "input" | "derived">

Capability handed to a FamilyFactory. Closes #257 (capability narrowing across factory/selector seams): a factory exists to register one node per key, so it gets input + derived and nothing else.

The narrowing is structural — a real Graph is assignable to FamilyGraph, but a factory cannot reach back into the engine for commit, read, hydrate, snapshot, exportModel, subscribeCommits, or any other authority outside its registration job. read is intentionally excluded: a derived node has its own get-tracked accessor inside the compute closure, and a factory that reads outside that closure would observe a snapshot at the wrong time and break dynamic-dependency tracking. SPEC §12.3 "smallest interface a consumer needs"; PR #205 introduced the same lens for the test-seam narrowCapability. This is the production- code analogue, applied at the type level so the discipline holds at compile time rather than depending on a runtime Proxy.