acl: Phase 3 explanation + audit, 35 tests

explain.sx reconstructs a canonical proof tree (first-rule, first-solution)
by goal-directed search over the saturated db, since Datalog keeps no
provenance; depth-capped for cyclic safety. acl-explain returns
{:allowed? :proof :reason} with the blocking eff_deny proof on denial.
audit.sx is an append-only decision log (monotonic seq, disk serializer).
api gains acl/explain, acl/audit, acl/audit-tail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/conformance.conf

@@ -17,10 +17,13 @@ PRELOADS=(
   lib/acl/schema.sx
   lib/acl/facts.sx
   lib/acl/engine.sx
+  lib/acl/explain.sx
+  lib/acl/audit.sx
   lib/acl/api.sx
 )
 
 SUITES=(
   "direct:lib/acl/tests/direct.sx:(acl-direct-tests-run!)"
   "inherit:lib/acl/tests/inherit.sx:(acl-inherit-tests-run!)"
+  "explain:lib/acl/tests/explain.sx:(acl-explain-tests-run!)"
 )