VM-gate Part A: durable audit record grammar

[TroyHernandez]

VM-gate increment — Part A (durable audit record grammar)

Draft, HELD. This is the code half of the VM-gated increment from
runix/docs/pkgops-vm-gate-plan.md (approved D1–D7). It merges before the VM
proof (D3); the exported-API PR #9 stays draft until Part B (the disposable-VM
proof) is green. No VM has been provisioned — this PR is hermetic code + tests only.

What it does

Enriches the committed outcome with the fields the broker's RECORD_SCHEMA
records, so the (soon) mutation-capable public API writes a complete, replayable
audit record instead of the earlier minimal placeholder .outcome_record().

• Observer (R/verify.R). .observe() reads the committed preview's resolved
  records into the record's observed object — the schema's only object field:
  {status, version} per package:arch for transaction/configure, {selection}
  for hold; absent → not-installed / "". .freeze_reader() caches the read so the
  verdict (.verify()) and the observed snapshot come from one post-commit read.
• state_changed is an observed diff (D7 = S-B). A pre-commit .observe()
  snapshot (.commit_session step 3.5) is compared with the post-commit state;
  state_changed is NA (omitted) whenever either side is unavailable. It is
  never inferred from effect_issued — that means the effect was issued, not
  that on-disk state moved.
• authorized_via provenance (R/polkit.R, plan §2.5). Decided at the
  authorization site as "pkexec" / "autonomous" / "pkcheck"; .authorize()
  now returns list(decision, via) so the class is recorded from complete state,
  never reconstructed downstream.
• Record grammar + guard (R/commit.R). .outcome_record() maps the outcome
  onto the broker's 16-field allow-list, omitting NA/NULL optionals (absent ==
  null at the broker); verified → changed only when the post-state was read,
  else changed is omitted (unknown, never a false "did not change").
  .validate_record() mirrors the broker guard: rejects any non-allow-list field,
  broker-reserved key, or wrong type before a record is built.

Two things to flag for review

1. Observation is success-path only. It matches the approved 5b scope (verify on
   the ok/no_op return path). The failure-path observed shape from plan §2.4 is
   deliberately deferred — not implemented here.
2. Single frozen post-read. .freeze_reader() makes the verdict and the
   observed snapshot share one installed()/selections() read, closing a
   verify/observe TOCTOU and halving the post-commit reads. The verdict semantics
   from 5a/5b are unchanged.

Scope / safety

• No new dependency: the pkgstate reader stays behind the injectable seam from 5a
  (pkgstate already in Imports).
• The positive allow-list is enforced broker-side; this PR mirrors the guard
  locally. That the local record survives the real broker is exactly what Part B
  proves — the R adapter rejects reserved keys but does not itself enforce the
  positive allow-list, so a hermetic pass is necessary but not sufficient.
• 648 tinytest green. R CMD check: 0 errors, 0 notes, 1 warning (New submission).