assay-authz

In-process authorization engine: policy statements, grants-at-scope with typed bounds, ABAC conditions, deny-wins, asymmetric fail-closed. Decision-identical to the agentauthz conformance fixtures.