feat: adapter contract, commerce proof-of-fit, and reusability docs

Proves the engine did not stay video-specific during extraction.

- application adapter contract in core (createApplicationAdapter,
  evaluateObject, collectTargets): an object names the targets that govern it
  and the strictest verdict reaching any of them wins, so denying a seller
  takes their whole catalogue down with no cascade logic in the application
- examples/commerce: a marketplace on the public API covering all ten
  proof-of-fit behaviors the plan requires, including that no core change was
  needed. One product, one snapshot, four surfaces, four different verdicts.
- README, integration guide, per-example README, CHANGELOG, four ADRs, and
  GPL-3.0-or-later LICENSE (the license was listed in Phase 1 but missing)
- checkpoints rewritten to reflect actual state and to say plainly which
  migration-plan phases belong to the consumer repos rather than here

Fixes a real gap found by the proof-of-fit: composeDecisions kept only the
first decision's evidence, so an object governed by several targets lost the
evidence that drove its verdict. Evidence now merges — counts summed,
contributor lists unioned, flags or-ed.

556 tests; lint, typecheck, and per-package type build clean.

docs/adr/0003-generic-engine-application-policy.md

@@ -0,0 +1,34 @@
+# ADR 0003 — The engine carries no thresholds
+
+**Status:** accepted
+
+## Context
+
+The extraction started from one application's numbers: blur at 3 trusted
+reports, hide at 20 trusted mutes, a 60-day mute window. Those were nearly
+promoted into the core as defaults, which would have made every future consumer
+inherit a video application's editorial judgement.
+
+## Decision
+
+The core defines the *vocabulary* — target types, capabilities, effect ladders,
+reason identifiers, aggregation and precedence rules — and no thresholds.
+Applications supply a `PolicyDefinition` of named profiles with category
+thresholds. The characterized reference values live in
+`@nostr-governance/bitvid-compat` as one application's profile.
+
+`NEUTRAL_POLICY` is the fallback: it enforces administrative denial and applies
+no trust thresholds, so the generic engine never hides content merely because
+one trusted account acted against it.
+
+## Consequences
+
+A new consumer writes a policy instead of arguing with a default. The commerce
+example needed no core change, which is the test this decision has to pass.
+
+An application that supplies no policy gets very little enforcement. That is
+deliberate: silently applying someone else's moderation thresholds is worse than
+applying none, because the operator would not know it was happening.
+
+Threshold `0` means "gate disabled" rather than "fires on everything", so
+zeroing a value is a safe way to switch a gate off.