fix: defeasible reason codes, _subjectAsObject unary semantics, checker reason whitelist

- LogicalOperators normal mode now emits top-level reason codes
  (never_rule_triggered / requirements_not_met / defeated_by_unless) when a
  defeasible rule resolves to 0, instead of degrading to no_matching_rule.
- RuleEvaluator honors rule._subjectAsObject: unary DSL predicate calls inside
  binary evidence (banned(user) within can_open(user, doc)) check the relation
  on the subject itself, matching the unary fact's self-edge.
- AuthorizationChecker reason whitelist now preserves the defeasible reason
  codes so the checker reports why a defeasible rule denied.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/core",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Arbiter core engine: graph indices, relation/reachability, authorization rule evaluator, DSL/AST, condensed & sharded snapshots, and evidence fusion.",
   "license": "ISC",
   "author": "",