3b increment 4b: wire polkit authorization into .commit_session

[TroyHernandez]

Wires the polkit authorization decision (increment 4a) into the commit
orchestrator — contract §4.3 step 2, including the plain-intent terminal refusal
path. Still hermetic (the broker, pkexec/pkcheck, and dpkg are all behind
seams) and still internal: pkgstate verification and the exported API remain.

The branch

Step 2 runs .authorize(verb_spec, interactive) after the capability
negotiation and before the effect intent is opened:

decision	what happens
authorized	proceed to the effect intent (the existing open→commit→classify→write_outcome path)
unauthorized / approval_required (machine mode)	.refuse(): open a plain intent (no receipt) via the seam's refuse op and write the terminal outcome (effect_issued = FALSE) under one broker cid, then signal runix_unauthorized / runix_approval_required. No effect intent is ever opened for a refusal, so no unused effect receipt is minted (§4.4).
check_failed	fail closed with nothing recorded (pkgops_polkit_check_failed) — there is no authoritative decision to persist

The refusal record is the "close" that precedes the signal, so a refused attempt
is durably audited. If the refusal record itself cannot be written, that error
propagates — either way no effect ran.

interactive is a caller-supplied parameter (runix exposes no TTY probe, so
mode detection stays at the CLI layer); default FALSE = machine mode.

Supporting pieces

• .verb_spec_for() (verbs.R): recover the verb spec (for the polkit
  action) from a preview's request verb; a hand-built preview with an unknown verb
  is refused before anything opens.
• the refuse op on the session-ops seam (session_ops.R) = broker_audit_sink()
  • audit_two_phase() with a no-op effect and a terminal-outcome record; keeps
    the plain-intent path hermetic. (Confirmed against the runix API: this is the
    exported plain-intent open+write pair, root-peer-authenticated, one cid.)
• the approval_required → runix_approval_required outcome status
  (.PKGOPS_POLKIT_CONDITION, outcome.R); unauthorized is shared with the
  session-level channel (same status, same condition).

Tests

27 new (433 total): each decision drives the branch; a refusal records a plain
intent and never opens the effect intent (seq == c("capability","refuse"));
capability precedes the decision; interactive skips pkcheck; a failed refuse
record propagates; an autonomous update proceeds for a member.

Points for review

1. Order: capability (step 1) runs before the polkit decision (step 2), per
   §4.3 — so even a refusal first negotiates the effect-receipt capability. It's
   contract-ordered and confirms the broker is reachable before anything; flag if
   you'd rather the refuse path skip capability.
2. check_failed → pkgops_polkit_check_failed, nothing recorded — a
   pkgops-owned outcome the contract taxonomy doesn't name (like
   pkgops_spawn_failed). Opening no intent for a check that couldn't run seemed
   right (no authoritative decision to persist), but flagging the choice.
3. The plain-intent refusal record grammar (operation/resource/
   effect_issued/outcome) is minimal, like .outcome_record() — pinned
   against a real broker in the VM-gated increment.

CI hermetic; R CMD check clean but for the expected "New submission" WARNING.

[TroyHernandez]

Fixed in the latest commit. .refuse() now requires res$audit_persisted == TRUE and a valid broker cid (.valid_broker_cid, pinned to runix's .BROKER_CID_RE = ^[0-9]{20}-[0-9a-f]{16}$) before signaling a closed refusal; otherwise it fails closed as runix_broker_error and does not report the refusal as closed. Regression tests cover audit_persisted=FALSE, a malformed cid, a missing audit_persisted field, and the cid grammar.