Implement promotion_eligible (closed ∧ drift≤ε), promote live
closure/drift refuse even when authorized, require_proof, and
prune(mode=principal_axes) keeping primals + highest principal-energy
non-primals (differs from FIFO). Proof fields never trusted as truth.
Ledger #18 flipped green; ADR-0092 reviewer service remains external.
Add GoldPromotionProof, expand promote/prune signatures, promotion_eligible
stub, and behavioral suite for residual/closure gates, require_proof,
principal_axes prune, and SERVE containment. Intentionally incomplete:
principal_axes and eligibility raise NotImplementedError; dirty promote
still admitted — RED until GREEN.
