sanitize

Returns a copy of catalog safe to overlay onto descriptor: nominated inputs/outputs that do not resolve are dropped, and each surviving input's NominatedInputKind is re-derived from the descriptor (kind is a derived property, never authoritative in the file). Order is preserved.