initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

benchmarks/sharded-snapshot-query.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+import { ShardedSnapshot } from '../src/core/shards/ShardedSnapshot.js';
+import path from 'node:path';
+import { FileShardStorage } from '../src/core/shards/FileShardStorage.js';
+
+const manifestPath = process.argv[2];
+if (!manifestPath) {
+  console.error('Usage: node new-eval/sharded-snapshot-query.js <manifest.json>');
+  process.exit(1);
+}
+
+const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+const storage = new FileShardStorage(path.dirname(manifestPath));
+const snapshot = new ShardedSnapshot(manifest, storage, { cacheLimit: 8 });
+snapshot.initializeSync();
+
+async function run() {
+  const relationId = 0;
+  const srcId = 0;
+  const dstId = 0;
+  const edge = snapshot.findEdgeSync(srcId, relationId, dstId);
+  console.log({ edge });
+}
+
+run().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});