acl: Phase 1 direct grants + deny-overrides, 24 tests

Datalog ACL layer (schema/facts/engine/api) over lib/datalog/. Direct
grant permits unless explicit deny names same (S,A,R) — deny-overrides
via stratified negation. Conformance wrapper + scoreboard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/scoreboard.json

@@ -0,0 +1,10 @@
+{
+  "lang": "acl",
+  "total_passed": 24,
+  "total_failed": 0,
+  "total": 24,
+  "suites": [
+    {"name":"direct","passed":24,"failed":0,"total":24}
+  ],
+  "generated": "2026-06-06T16:31:36+00:00"
+}