feat: add AI-native warehouse governance reference implementation

[Liyurun]

Summary

• add deterministic baselines, statement-aware graph identity, drillable TableGraph provenance
• add evidence coverage/counterevidence, GraphRAG grounding, autonomy gates, reversible actions, independent verification, and hash-chained audit replay
• add governance CLI, three book cases, and the 94-table/62-task DuckDB governance workbench aligned with the existing Explorer style
• add capability ledger, book mapping, limitations, golden/safety/scale tests, and release gates

Release evidence

• 344 tests passed
• foundation coverage: 89.29%
• clean Python 3.12 wheel install and governance run/verify/replay passed
• 1,000 SQL: 0.997s, 11.45 MB peak
• 10,000 SQL: 10.16s, 113.17 MB peak
• desktop 1440x1000 and mobile 390x844 browser checks passed
• open-source, layering, deterministic-ID, capability, package-build, and generated-asset gates passed

Safety

• irreversible actions are forced to L4
• missing evidence or grounding blocks execution
• repeated execution is idempotent
• execution/verification failures open the circuit and use verified rollback
• audit tampering or event reordering is detected

No generated databases, reports, screenshots, book archives, or local benchmark outputs are included.