Engine: proof pinned to the commit snapshot (EN-7) #260

Goal. A proof pinned to the commit snapshot: a proof statement at the end of a program, evaluated on the snapshot the guard passed on, and returned in the reply.

Why. The stored proof of a decision must be the proof of the state the commit gate checked. Today .why runs afterwards on a later snapshot, so a claim guarded on eligibility can already have withdrawn that eligibility.

Done when. A program can end with a proof request whose tree is computed on the commit snapshot and returned with the write reply; the proof's revision equals the commit revision; tests cover a racing write between guard and proof.

Plan reference: EN-7. Part of the Engine production readiness milestone (the current focus; tracker #199). Rule for every engine PR: millisecond query and update latency must not regress, and the perf gate runs before the PR opens.