feat(control): publish signed decision and action-hook contracts

[TeoSlayer]

Summary

• publish signed intent, decision, disclosure, approval, mandate, receipt, and federation contracts used at managed-node boundaries
• publish the harness-neutral before/after action-hook contract
• include local verification, enforcement, quota, evidence, and workflow primitives
• keep hosted evaluators, tenancy, persistence, and management UI out of this public module

Verification

• GOWORK=off go test -race ./decision ./actionhook
• GOWORK=off go vet ./decision ./actionhook

This decouples the public node and governed transports from the private hosted platform source.

[codecov]

Codecov Report

❌ Patch coverage is 59.35240% with 1293 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
decision/workflow.go	68.75%	80 Missing and 70 partials ⚠️
decision/evaluator.go	66.46%	77 Missing and 34 partials ⚠️
decision/decision.go	62.54%	56 Missing and 47 partials ⚠️
decision/mandate.go	51.75%	57 Missing and 39 partials ⚠️
decision/approval.go	62.08%	48 Missing and 43 partials ⚠️
decision/federation_result.go	0.00%	82 Missing ⚠️
decision/usage_export.go	65.65%	53 Missing and 26 partials ⚠️
actionhook/hook.go	45.86%	58 Missing and 14 partials ⚠️
decision/receipt.go	63.68%	36 Missing and 29 partials ⚠️
decision/receipt_export.go	58.53%	31 Missing and 20 partials ⚠️
... and 14 more

📢 Thoughts on this report? Let us know!