js-rigor: security affordances — gated provenance, audit hook, DoS hardening, explicit semantics

Per the trust-boundary direction (the caller owns evidence validation):

- Explicit possibilistic semantics module (src/core/possibility.js): the
  single authoritative home for what each operator means (max = disjunctive
  already-valid; min = unvalidified conjunctive ranking with the K-
  validification and surfaced conflict mass; product = Thm-4 heuristic;
  interior OWA = non-maxitive heuristic; reliability = adaptation, never
  conflated with plausibility).
- Provenance is opt-in (re-entrant tracing practice): default check
  results carry only {label, operator, regime}; conflictMass,
  validifiedPossibility, sources, and nonMaxitive appear only under
  includeMeta and on the explain surface. The direct-check cache now
  caches only the meta-less form — includeMeta callers always get a fresh
  full evaluation (previously a cached minimal result was served for
  includeMeta requests, silently stripping detail).
- Audit affordance: new Arbiter({ audit }) emits one record per check
  (decision, possibility, binary, partialGraphUsed, validityLabel,
  sources). The engine stores nothing — the caller owns persistence;
  zero cost when the hook is absent (and the full validity is forced only
  on audit-enabled deployments).
- DoS hardening: partial-graph size limits are enforced BEFORE the
  context allocation (the caller-supplied overlay is the per-check
  allocation point); the CondensedGraphBinary reader gained full bounds
  guards so malformed snapshot buffers fail with clean errors instead of
  RangeError crashes or oversized allocations.
- New security-affordance pins: gating, audit records, and pre-allocation
  limits.

src/authorization/rules/DirectRule.js

@@ -71,9 +71,7 @@ export class DirectRule extends BaseRule {
     const authResult = {
       possibility: relationStrength,
       reliability: directRel.reliability !== undefined ? directRel.reliability : 1.0,
-      validity: directRel.validity !== undefined
-        ? this._validity('identity', [relName], [this._relationValidity(directRel)], 1, relationStrength)
-        : this._defaultValidity(),
+      validity: this._validity('identity', [relName], [this._relationValidity(directRel)], 1, relationStrength),
       possibility_allow: relationStrength,  // For binary mode
       possibility_deny: 0,                 // DirectRule doesn't deny
       ...(includeMeta && {