feat: intermediate chain condition steps + _subjectIsObject unary scoping

- _expandChainSteps: a logical/defeasible evidence referenced by a chain step
  is now a condition step ({ rule, conditionStep }) at ANY position. As the
  FINAL step the engine verifies it at (intermediate, object); as an
  INTERMEDIATE step the engine expands it from the current node (rule-based
  reachability: base edges' destinations filtered by the rule's
  defeaters/requirements) and continues traversal from each discovered node.
- buildPredicateRule / buildDirectRule: unary predicate calls whose subject
  entity IS the evidence's object parameter (trusted(other) inside
  peer_trusted(user, other)) are marked _subjectIsObject (was: only subject-var
  calls got _subjectAsObject). Requires @arbiter/core@^1.0.4.

Tests: ChainConditionStep intermediate expansion; oracle campaign gains a
chain_intermediate_condition construct (oracle = min(peer*(1-trusted), read)).

tests/ChainConditionStep.test.js

@@ -98,4 +98,32 @@ describe('Chain condition step (logical evidence as final hop)', () => {
     // max over paths: min(0.5,0.7)=0.5, min(1.0,0.8)=0.8 -> 0.8
     assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.8);
   });
+
+  it('expands an INTERMEDIATE condition step via rule-based reachability', () => {
+    const { arb, result } = compile(`
+      definition Employee { id: string }
+      definition Doc { id: string }
+      fact peer(user: Employee, other: Employee)
+      fact trusted(other: Employee)
+      fact can_read(user: Employee, doc: Doc)
+      evidence peer_trusted(user: Employee, other: Employee) { WHEN peer(user, other) UNLESS trusted(other) }
+      evidence can_access(user: Employee, doc: Doc) { peer_trusted(user, *p) { can_read(p, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_access').steps;
+    assert.equal(steps[0].conditionStep, true);
+    assert.equal(steps[0].rule.type, 'logical');
+
+    arb.addNode('u:1', 'Employee'); arb.addNode('p:1', 'Employee'); arb.addNode('p:2', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'peer', 'p:1', { possibility: 1.0 });
+    arb.addRelation('u:1', 'peer', 'p:2', { possibility: 1.0 });
+    arb.addRelation('p:1', 'trusted', 'p:1', { possibility: 1.0 }); // p:1 filtered
+    arb.addRelation('p:1', 'can_read', 'doc:9', { possibility: 0.9 });
+    arb.addRelation('p:2', 'can_read', 'doc:9', { possibility: 0.7 });
+    // only untrusted peer p:2 survives the intermediate condition -> 0.7
+    assert.equal(arb.check('u:1', 'can_access', 'doc:9').possibility, 0.7);
+    // trusting p:2 too removes all intermediates -> 0
+    arb.addRelation('p:2', 'trusted', 'p:2', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_access', 'doc:9').possibility, 0);
+  });
 });