initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

benchmarks/shard-size-distribution.js

@@ -0,0 +1,41 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const manifestPath = process.argv[2] || 'tmp/shards-bench/manifest.json';
+const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+const baseDir = path.dirname(manifestPath);
+
+const shardSizes = [];
+for (const shard of manifest.shards || []) {
+  const filePath = path.join(baseDir, shard.key);
+  const stat = fs.statSync(filePath);
+  shardSizes.push({
+    key: shard.key,
+    bytes: stat.size,
+    relationId: shard.relationId,
+    direction: shard.direction,
+    rangeStart: shard.rangeStart,
+    rangeEnd: shard.rangeEnd,
+    edgeCount: shard.edgeCount
+  });
+}
+
+if (!shardSizes.length) {
+  console.log('No shards found.');
+  process.exit(0);
+}
+
+shardSizes.sort((a, b) => a.bytes - b.bytes);
+const totalBytes = shardSizes.reduce((sum, s) => sum + s.bytes, 0);
+const toMb = (bytes) => (bytes / 1024 / 1024).toFixed(2);
+const pick = (q) => shardSizes[Math.floor((shardSizes.length - 1) * q)];
+
+console.log('Shard size distribution');
+console.log(`  shards: ${shardSizes.length}`);
+console.log(`  total: ${toMb(totalBytes)} MB`);
+console.log(`  avg: ${toMb(totalBytes / shardSizes.length)} MB`);
+console.log(`  p50: ${toMb(pick(0.5).bytes)} MB`);
+console.log(`  p90: ${toMb(pick(0.9).bytes)} MB`);
+console.log(`  p95: ${toMb(pick(0.95).bytes)} MB`);
+console.log(`  p99: ${toMb(pick(0.99).bytes)} MB`);
+console.log(`  max: ${toMb(shardSizes[shardSizes.length - 1].bytes)} MB`);