feat: value-gated direct rules, per-value cache keys, NOT negation; fix value-object checks

DirectRule and the direct-check fast path now enforce expectedValue from a DSL
literal (balance(user, 5)) or a per-check value-object override, closing a
silent over-grant where any edge of a value-carrying fact matched. Rule and
decision caches append :v<value> so different amounts never share a key.
NOT negation is applied after union/intersection/exclusion evaluation (the
only negation site was dead code in evaluateLogical), so NOT x now returns
1 - p instead of the raw possibility.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/core",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Arbiter core engine: graph indices, relation/reachability, authorization rule evaluator, DSL/AST, condensed & sharded snapshots, and evidence fusion.",
   "license": "ISC",
   "author": "",