feat(validation): add runtime plan authorization

[HayronHgh]

Scope

This PR implements M3 only as 0.2.0-dev.3.

It converts an untrusted CompactionPlan proposal into a distinct, deterministic ValidatedPlan and then stops:

CompactionPlan
      ↓
Runtime Validator
      ↓
ValidatedPlan
      ↓
STOP

This PR does not execute plans, transform or mutate context, create artifacts, promote or write memory, change authority/lifecycle, call Qwen or llama.cpp, or alter the frozen deterministic context policy.

What changed

Runtime-owned authorization

• add src/compaction-validator.js
• add the pure validateCompactionAuthorization({ plan, inventory, pressure }) API
• preserve proposed actions instead of silently rewriting rejected actions to KEEP
• return per-decision AUTHORIZED, REJECTED, or AUDIT_ONLY
• make PROMOTE_PROPOSAL audit-only with no persistence path

Safety policy

• data-drive the authority matrix through frozen AUTHORIZATION_POLICY
• make isRecoverable() and isDurablyRecoverable() explicit
• treat artifact, repository, and memory recovery as durable exact-enough
• treat rebuildable as recoverable but not durable
• evaluate protection before authority, recoverability, dependency closure, and Planner importance
• keep Planner importance audit-only with no override power

Dependency closure

• build the complete depends_on graph before authorization
• reject missing targets and cycles for the whole plan
• compute transitive closure
• authorize against post-action availability rather than prompt presence
• keep recoverable externalized/evicted dependencies available
• reject unavailable required dependencies with ACTIVE_DEPENDENCY

Token accounting

• take requiredReductionTokens only from Runtime pressure
• report only potentialReductionUpperBound
• keep actualReductionTokens: null before execution
• reject COMPRESS when targetTokens >= unit.tokens
• mark externalize/evict replacement cost unknown
• distinguish:
  • AUTHORIZED_DEFINITELY_INSUFFICIENT
  • AUTHORIZED_POTENTIALLY_SUFFICIENT
  • REJECTED

Documentation and fixtures

• add bilingual Compaction Authorization documentation
• update bilingual RFC-001, architecture, technical report, README, and changelog
• update the package/CLI version to 0.2.0-dev.3
• add a fixed Runtime validation fixture and full M3 policy matrix

Safety boundary

The Validator is deterministic, model-free, and observational. Validation does not mutate plans, inventories, messages, project memory, episodes, artifacts, context, authority, or lifecycle.

The following frozen/runtime files are unchanged:

src/context-manager.js
src/agent-runtime.js
src/memory-store.js
src/tool-evidence.js

Validation

• npm.cmd test: 96 tests/subtests, 95 passed, 1 Windows file-symlink capability skip
• all JavaScript source and tests pass node --check
• all JSON fixtures parse
• all PowerShell scripts parse
• all Markdown relative links resolve
• git diff --check is clean
• frozen-file diff is empty
• Validator forbidden-dependency scan is clear: no filesystem writes, Runtime/MemoryStore/context-manager imports, Qwen, llama.cpp, or network calls

Next milestone

0.2.0-dev.4 will add bounded Qwen proposal generation only. Transformation and validated execution remain separate for 0.2.0-dev.5.