cwn-trust-gate

Signed receipts for agent actions and a read-only-allowlist decision gate. Seven tools: gate_decision, verify_receipt, mint_action_receipt, mint_receipt_for_record_change, audit_my_agent_inventory, check_egress and run_exit_drill. Receipts are signed with Ed25519, plus ML-DSA-65 when the post-quantum backend is available. A receipt shows what was signed; pass expected_kid to verify_receipt to pin which key signed it. The gate judges action names and resources against a read-only allowlist and do