initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

src/ast/validation/DSLPrelude.js

@@ -0,0 +1,37 @@
+export const DSL_PRELUDE = `
+// Built-in types and relations available in every graph.
+// These are intended for request-scoped auth/session evidence (partial graph inputs).
+
+definition User {
+  id: string
+}
+
+definition Account {
+  id: string
+  tier: string
+}
+
+definition Device {
+  id: string
+  device_risk: number
+  auth_method: string
+  ip_address: string
+  user_agent: string
+}
+
+definition AuthSession {
+  login_time: timestamp
+  last_login_time: timestamp
+  mfa_used: boolean
+  auth_method: string
+  ip_address: string
+  user_agent: string
+  expires_at: timestamp
+  device_risk: number
+}
+
+fact session_for_user(user: User, session: AuthSession)
+fact session_for_account(account: Account, session: AuthSession)
+fact session_for_device(device: Device, session: AuthSession)
+fact logged_in_as(device: Device, account: Account)
+`;