Add Proof Pack v0.1 for DecisionRecord authority-before-mutation

[LalaSkye]

This PR adds Proof Pack v0.1 for commit-gate-core.

It provides a bounded, reviewer-friendly proof surface for the existing CommitGate path.

Included files:

• demo/valid_decision_record.json
• demo/expired_authority_refusal.json
• demo/scope_mismatch_refusal.json
• demo/replayed_nonce_refusal.json
• scripts/run_proof_pack.py
• scripts/verify_receipt.py
• docs/PROOF_PACK_v0.1.md
• receipts/examples/allow_receipt.json
• receipts/examples/deny_expired_receipt.json
• receipts/examples/deny_scope_receipt.json
• receipts/examples/deny_replay_receipt.json

What this demonstrates:

• valid DecisionRecord → mutation allowed → ALLOW receipt
• expired authority → mutation refused → DENY_EXPIRED receipt
• scope mismatch → mutation refused → DENY_SCOPE receipt
• replayed nonce → mutation refused → DENY_REPLAY receipt

The runner prints:

• case name
• expected result
• actual result
• receipt path
• receipt hash
• mutation occurred: YES / NO

The verifier checks:

• receipt hash integrity
• input hash
• decision result
• refusal reason
• no-execution marker

Claim boundary:
This does not claim production infrastructure, certification, adoption, or universal runtime governance.

It demonstrates a bounded path-local claim:
state mutation is refused unless a DecisionRecord is valid, scoped, unexpired, signed, and unreplayed; each refusal produces an inspectable receipt.

Test status:

• Proof Pack v0.1 passes locally
• receipt verifier passes locally
• existing test run: 25 passed
• 4 pre-existing failures remain in `test_changed_condition_refusal.py`
• kernel source was not modified

Base:
main @ 4a1462c

Local commit:
e102a86

[LalaSkye]

Post-merge custody note:

Proof Pack v0.1 is now available on main in commit-gate-core.

Merge result:

• PR: Add Proof Pack v0.1 for DecisionRecord authority-before-mutation #20
• Merge method: squash merge
• Merge commit: 4620e61
• File custody: PASS — 11/11 proof-pack files present on main
• CI/checks: PASS — 3/3 successful
• Claim-boundary review: PASS

Claim boundary:
This records availability on main only. It does not claim adoption, certification, production readiness, standards compliance, or external validation.