Cardinality of an injection between two finite sets

The pattern is a DISTINGUISHING substring of the admitted type, not the declaration's name: an existence check would still pass if the statement drifted. Verified to hit ZERO on a perturbed pattern before this row was written -- see the mutation table in ADR-1593. `kernel_declaration_projection` prints every declaration with its footprint size and its rendered type, and the prelude build admits this theorem only through the trusted gate, so a successful build IS the type-check. `grep -cF -e` rather than `grep -cF`: a pattern beginning with `-` is parsed as an OPTION, and five of these seven do. The table in ADR-1593 caught that -- the rows failed as written before `-e` was added, which is why it was run at all.

The pattern pins BOTH the declaration name and the footprint size 0, so a proof that reached for a trusted declaration would fail the check rather than be reported as axiom-free. A one-character name typo hits zero rows, and so does asking for any size other than 0.

The trusted gate cannot tell a THEOREM's statement is not what its name says: a `card_le_of_injOn` with its two `card`s transposed, an `exists_collision` whose pair need not be DISTINCT, or a `pigeonhole` whose strict inequality points the other way would each be admitted, carry an empty axiom footprint, and pass every other row in this ledger. `nat_prelude/finset_pigeonhole_tests.rs` instantiates each statement at a concrete pair of sets whose cardinalities are computed independently, and pairs every positive with the wrong statement it rules out. Three of its controls are the sharper kind, where a hypothesis cannot be DISCHARGED (`infer` must fail) rather than a conclusion merely being false.