feat(engine): add Sentry enforcement and native Herald rendering

[tcballard]

Summary

• add native Rust decided sentry and compose it into decided gate --code
• enforce forbid_pattern, require_pattern, and forbid_import deterministically
• support full-tree certification and added-line Git diff enforcement
• publish decision coverage in human/JSON output and violations as SARIF
• validate malformed constraint blocks during ordinary corpus validation
• provide Python, Rust, and JavaScript/TypeScript import adapters with no Python runtime or model judge
• move Herald collection, deduplication, sorting, and Markdown rendering into native decided herald

Contract dependency

Depends on asdecided/spec#6. The vendored registry is intentionally advanced to that contract, so Guard 1 becomes green when the Spec PR merges.

Validation

• cargo test --workspace (70 engine tests plus workspace/integration suites)
• cargo clippy --workspace --no-deps -- -D warnings
• cargo check --workspace
• full-tree Sentry CLI smoke
• real Git diff enforcement test
• native Herald deterministic rendering, overflow, deduplication, and empty-state tests

All local checks pass. This stays draft until the Spec dependency lands.