initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

tests/rules/remediation-flow.test.js

@@ -0,0 +1,35 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+
+describe('Unified remediation flow', () => {
+  test('unified remediation options contain relation and object identity', () => {
+    const remediation = {
+      status: 'required',
+      options: [{
+        relation: 'mfa',
+        object: 'user:1',
+        type: 'source'
+      }]
+    };
+
+    assert.equal(remediation.status, 'required');
+    assert.equal(remediation.options.length, 1);
+    assert.equal(remediation.options[0].relation, 'mfa');
+    assert.equal(remediation.options[0].object, 'user:1');
+    assert.equal(remediation.options[0].type, 'source');
+  });
+
+  test('multiple injectable predicates produce multiple remediation options', () => {
+    const remediation = {
+      status: 'required',
+      options: [
+        { relation: 'mfa', object: 'user:1', type: 'source' },
+        { relation: 'request_balance', object: 'user:1', type: 'measure' },
+        { relation: 'session_for_user', object: 'user:1', type: 'fact' }
+      ]
+    };
+
+    assert.equal(remediation.options.length, 3);
+    assert.ok(remediation.options.every(o => o.relation && o.object && o.type));
+  });
+});