Override the source fact on every query shape

- drop upstream facts of the configured name whenever the feature is enabled,
  independent of the per-query injection gate, and log the drop once per request
- walk the whole AST for a nested extract and skip injection when one is found
  outside an in subquery
- skip the environment scan on /facts when nothing is injected
- document the override rule and that PQL-syntax queries never get the fact

server.go

@@ -258,11 +258,15 @@ func (s *Server) mergeNodesResponse(r *http.Request) func([]backendResult) []jso
 func (s *Server) mergeFactsResponse(r *http.Request) func([]backendResult) []json.RawMessage {
 	inject := s.newSourceInjector(r.URL.Query().Get("query"), true)
 	return func(results []backendResult) []json.RawMessage {
+		var merged []json.RawMessage
 		if s.cfg.Merge == mergeStatic {
-			return mergeFacts(results, nil, inject)
+			merged = mergeFacts(results, nil, inject)
+		} else {
+			fresh := s.freshnessMap(context.Background(), results)
+			merged = mergeFacts(results, func(cn string) string { return fresh[cn] }, inject)
 		}
-		fresh := s.freshnessMap(context.Background(), results)
-		return mergeFacts(results, func(cn string) string { return fresh[cn] }, inject)
+		inject.logSuppressed(s.log)
+		return merged
 	}
 }