feat(foundation): offline synthetic scope/permission inspector (FI-FILBERT-8 APPROVED r6)

Rocko-authored, Filbert-reviewed inspector (r6 manifest
a4a44930...) with full review/build/verdict evidence under
docs/plans/reviews. 43/0 selftests, oracle zero-disagreement,
foundation checker PASS. Owner A9 acceptance recorded separately.

scripts/foundation/fixtures/demo/prop-message-is-not-authority.expected.txt

@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: refused
+reason: not-authorized
+rule: message-is-not-authority
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: assignment.change target null
+proposal: refused (not-authorized; message-is-not-authority) selected assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+diagnostic: null