acl: hardening suite (+25) — diamonds, cycles, validation, audit save/restore

New adversarial/cross-phase coverage: diamond resource+group hierarchies
(deny wins per path), chain inheritance + leaf deny, cycle termination,
multi-peer delegation, fact validation, audit snapshot/restore round-trip.
Adds acl-validate-facts/acl-facts-valid? (schema) and acl-audit-snapshot/
restore!/copy (audit). Fixed acl-audit-restore! rebuilding the live log via
map (append! silently no-ops on map-derived lists).

Suite is prover-free: a substrate JIT bug loops the recursive proof
reconstructor on deep chains in warm processes (documented in Blockers);
acl-permit? is unaffected. 145/145.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/scoreboard.md

@@ -1,6 +1,6 @@
 # acl scoreboard
 
-**120 / 120 passing** (0 failure(s)).
+**145 / 145 passing** (0 failure(s)).
 
 | Suite | Passed | Total | Status |
 |-------|--------|-------|--------|
@@ -8,3 +8,4 @@
 | inherit | 30 | 30 | ok |
 | explain | 35 | 35 | ok |
 | fed | 31 | 31 | ok |
+| harden | 25 | 25 | ok |