feat: add enterprise governance and signed evidence

[Victoria824]

What changed

• adds deny-by-default enterprise policy-as-code with mandatory tenant binding, RBAC action/resource authorization, classification clearance, approval obligations, and governed break-glass access
• adds redacted, tamper-evident HMAC-SHA256 evidence envelopes with atomic owner-only writes, age checks, and controlled malformed-input handling
• adds enterprise CLI commands, a six-scenario zero-key governance demo, operator documentation, and v0.6.0 release notes
• upgrades the web toolchain, removes the vulnerable ESLint dependency chain, and enforces TypeScript type checking
• extends CI and release workflows to run the enterprise demo, type checks, security audits, and artifact validation

Why

QueryAssure needs production-oriented controls around tenant isolation, high-impact agent actions, traceable authorization decisions, and audit artifact integrity—not only model-output checks. This release turns those controls into versioned, testable contracts.

Validation

• 44 Python tests pass
• Ruff and Bandit pass
• pip-audit reports no known vulnerabilities
• TypeScript strict checks pass
• Vinext build and rendered-page tests pass
• GitHub Pages static build passes
• npm audit reports 0 vulnerabilities
• enterprise governance demo passes 6/6 scenarios
• wheel and sdist build successfully with packaged policy resources
• diff and secret-pattern checks pass

Release impact

This PR prepares QueryAssure v0.6.0. The tag workflow will publish signed checksums, Python artifacts, and versioned GHCR images after merge.