acl: hardening suite (+25) — diamonds, cycles, validation, audit save/restore

New adversarial/cross-phase coverage: diamond resource+group hierarchies
(deny wins per path), chain inheritance + leaf deny, cycle termination,
multi-peer delegation, fact validation, audit snapshot/restore round-trip.
Adds acl-validate-facts/acl-facts-valid? (schema) and acl-audit-snapshot/
restore!/copy (audit). Fixed acl-audit-restore! rebuilding the live log via
map (append! silently no-ops on map-derived lists).

Suite is prover-free: a substrate JIT bug loops the recursive proof
reconstructor on deep chains in warm processes (documented in Blockers);
acl-permit? is unaffected. 145/145.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/scoreboard.json

@@ -1,13 +1,14 @@
 {
   "lang": "acl",
-  "total_passed": 120,
+  "total_passed": 145,
   "total_failed": 0,
-  "total": 120,
+  "total": 145,
   "suites": [
     {"name":"direct","passed":24,"failed":0,"total":24},
     {"name":"inherit","passed":30,"failed":0,"total":30},
     {"name":"explain","passed":35,"failed":0,"total":35},
-    {"name":"fed","passed":31,"failed":0,"total":31}
+    {"name":"fed","passed":31,"failed":0,"total":31},
+    {"name":"harden","passed":25,"failed":0,"total":25}
   ],
-  "generated": "2026-06-06T16:53:44+00:00"
+  "generated": "2026-06-06T22:43:27+00:00"
 }