feat: compile protected-effect integrity obligations

[fraware]

Purpose

Define the first stronger semantic obligation family on top of Assurance IR.

Each source-grounded semantic path ending in a protected effect is compiled into a standard OVK VerificationObligation with explicit:

• guard/path coverage requirement;
• principal binding;
• effect binding;
• resource binding;
• source IR digest;
• extraction coverage and unresolved semantics.

Core property

Performed(principal, effect, resource) -> Authorized(principal, effect, resource)

This PR defines the obligation structure only. It does not yet wire a backend that can establish every facet.

Binding semantics

Identity bindings are represented explicitly. Non-identical references can be connected through an explicit Assurance IR binding constraint. Missing bindings remain unresolved instead of being treated as equal.

Trust boundary

This PR does not claim:

• source extraction completeness or soundness;
• control-flow dominance of a guard;
• that an explicit binding expression is true;
• production-ready enforcement.

Those are intentionally left for backend/source-profile work.

Stack

This PR is stacked on #30 and targets feat/assurance-ir-v1; it should not be merged independently into main.

The current OVK v1.3.0-rc.1 release process remains isolated from both feature branches.