initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

tests/engine/owa-union.test.js

@@ -0,0 +1,31 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '../../src/core/Arbiter.js';
+
+describe('OWA union aggregation', () => {
+  test('union uses OWA weights for possibilities', () => {
+    const arbiter = new Arbiter();
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('resource:1', 'resource');
+
+    arbiter.addRelation('user:1', 'viewer', 'resource:1', 0.9);
+    arbiter.addRelation('user:1', 'owner', 'resource:1', 0.5);
+
+    arbiter.setRelationConfig('viewer', { type: 'direct' });
+    arbiter.setRelationConfig('owner', { type: 'direct' });
+    arbiter.setRelationConfig('can_view', {
+      union: {
+        rules: [
+          { type: 'direct', relation: 'viewer' },
+          { type: 'direct', relation: 'owner' }
+        ],
+        aggregator: 'owa',
+        owaWeights: [0.7, 0.3]
+      }
+    });
+
+    const result = arbiter.check('user:1', 'can_view', 'resource:1');
+    assert.ok(result);
+    assert.ok(Math.abs(result.possibility - 0.78) < 0.01);
+  });
+});