feat: adapter contract, commerce proof-of-fit, and reusability docs

Proves the engine did not stay video-specific during extraction.

- application adapter contract in core (createApplicationAdapter,
  evaluateObject, collectTargets): an object names the targets that govern it
  and the strictest verdict reaching any of them wins, so denying a seller
  takes their whole catalogue down with no cascade logic in the application
- examples/commerce: a marketplace on the public API covering all ten
  proof-of-fit behaviors the plan requires, including that no core change was
  needed. One product, one snapshot, four surfaces, four different verdicts.
- README, integration guide, per-example README, CHANGELOG, four ADRs, and
  GPL-3.0-or-later LICENSE (the license was listed in Phase 1 but missing)
- checkpoints rewritten to reflect actual state and to say plainly which
  migration-plan phases belong to the consumer repos rather than here

Fixes a real gap found by the proof-of-fit: composeDecisions kept only the
first decision's evidence, so an object governed by several targets lost the
evidence that drove its verdict. Evidence now merges — counts summed,
contributor lists unioned, flags or-ed.

556 tests; lint, typecheck, and per-package type build clean.

packages/core/test/evidence.test.js

@@ -1,6 +1,11 @@
 import { describe, expect, it } from "vitest";
 
-import { createEmptyEvidence, freezeEvidence, redactEvidence } from "../src/evidence.js";
+import {
+  createEmptyEvidence,
+  freezeEvidence,
+  mergeEvidence,
+  redactEvidence,
+} from "../src/evidence.js";
 
 const populated = () => ({
   ...createEmptyEvidence(),
@@ -71,3 +76,34 @@ describe("redactEvidence", () => {
     expect(redacted.trustedReportsByCategory).toEqual({ nudity: 1, spam: 2 });
   });
 });
+
+describe("mergeEvidence", () => {
+  it("sums counts across targets", () => {
+    const merged = mergeEvidence([populated(), populated()]);
+    expect(merged.trustedReportTotal).toBe(6);
+    expect(merged.trustedReportsByCategory.spam).toBe(4);
+  });
+
+  it("unions contributor lists without duplicating", () => {
+    const merged = mergeEvidence([populated(), populated()]);
+    expect(merged.trustedReporterPubkeys).toEqual(["aa", "bb", "cc"]);
+  });
+
+  it("ors the boolean flags", () => {
+    const denied = { ...createEmptyEvidence(), userDenied: true };
+    const blocked = { ...createEmptyEvidence(), personalBlock: true };
+    const merged = mergeEvidence([denied, blocked]);
+    expect(merged.userDenied).toBe(true);
+    expect(merged.personalBlock).toBe(true);
+    expect(merged.eventDenied).toBe(false);
+  });
+
+  it("tolerates empty and malformed input", () => {
+    expect(mergeEvidence([]).trustedReportTotal).toBe(0);
+    expect(mergeEvidence(/** @type {any} */ ([null])).trustedReportTotal).toBe(0);
+  });
+
+  it("returns sorted, stable output", () => {
+    expect(mergeEvidence([populated()])).toEqual(mergeEvidence([populated()]));
+  });
+});