Extract the shared diagnostic-object factory duplicated across 3 new Filter-role modules

[BorisTyshkevich]

Problem

Three new files added by #232 (feat/dashboard-filter-sources-160) each
hand-roll their own near-identical local factory for building a
{severity, code, message, ...extra} diagnostic object:

• src/core/dashboard-filters.js:4 — const diagnostic = (severity, code, message, extra = {}) => ({ severity, code, message, ...extra });
• src/core/filter-options.js:6 — const diag = (severity, code, message, extra = {}) => ({ severity, code, message, ...extra });
• src/core/filter-execution.js:11 — const diagnostic = (code, message) => ({ severity: 'error', code, message, path: ['dashboard', 'role'] }); (a narrower, error-only variant of the same shape)

Why deferred

Found during a pre-merge UI/UX + correctness review of #232, alongside 9
issues that were fixed directly. This one is pure simplification/reuse with
no user-visible behavior to verify, so it was left for a dedicated small PR
rather than folded into an already-large review-fixup commit — lower risk to
land on its own, easy to review in isolation.

Acceptance direction

• Add one shared diagnostic(severity, code, message, extra = {}) helper
  (e.g. in a new small src/core/diagnostics.js, or wherever the project
  prefers small cross-cutting core helpers to live) matching the two
  general-purpose implementations.
• Have filter-execution.js's narrower error-only factory call the shared one
  with severity: 'error' and its fixed path: ['dashboard', 'role'] extra,
  rather than duplicating the object-literal shape a third time.
• Update dashboard-filters.js and filter-options.js to import and use the
  shared helper instead of their local copies.
• No behavior change — this is a pure refactor; existing tests should pass
  unmodified (or with only import-path updates if any test imports the local
  factories directly).