feat(guardian): enforce execution authority and add ECDT validation

[aeonmatrixcommand-debug]

Summary

Introduces a fail-closed Guardian execution authority boundary and canonical ECDT application validation.

Guardian Execution Authority

• Adds ExecutionAuthorization
• Adds Guardian AuthorizationIssuer
• Binds authority to decision_id and action
• Adds authorization expiration/TTL
• Rejects invalid, expired, or mismatched authority
• Removes boolean authorization as trusted execution authority
• Preserves policy and approval gates before execution

ECDT Application Validation

• Adds canonical intelligence.ecdt package
• Adds ApplicationValidation
• Adds ApplicationValidationGate
• Validates verified evidence before application approval
• Resolves the previous intelligence.ecdt namespace/import collision

Security Properties

Execution requires:

1. Governance policy approval
2. Approval gate approval
3. Valid Guardian-issued execution authority
4. Authority bound to the exact decision
5. Authority bound to the exact action
6. Non-expired authority

Confidence alone is not execution authority.

Verification

• ECDT: 8 passed
• Guardian execution/governance: 21 passed
• Full regression: 183 passed, 1 skipped
• git diff --check: PASS
• Working tree: clean