Extend RuleOak without forking the authority kernel

The public SPI validates extension descriptors and keeps private/commercial implementations outside the public authority path.

Supported extension kinds

• organization_policy — supplies an additional policy document for explicit composition
• approval — routes approval requests to a configured provider
• event_sink — receives explicitly selected metadata events
• inspector_intelligence — non-authoritative capability intelligence
• crashlab_scenario — validated reliability scenarios

Hard boundary

Inspector intelligence is rejected if it attempts to return authority decisions. Authority Envelope, ExecutionLease, EffectReceipt, Policy v2, basic Inspector, Flight Recorder verification and basic CrashLab remain public trust foundations.