auths-evidence

The single trust implementation behind Auths evidence bundles: spend re-derivation, chain resolution, anchored per-call/per-log verdicts, and offline-verifiable EvidenceBundle build + verify. Shared by the gateway CLI, the first-party tool servers, and every language binding.