Clarify approval boundaries and operator conformance

[niejingchuan]

Summary

• clarify that approval.when is evaluated per invocation and cannot enforce aggregate or rolling-window limits
• define portable in, contains, and exists semantics using strict JSON behavior
• expand the ACC v1 reference corpus from 18 to 26 vectors
• add read-only CI for repository, conformance, and test checks
• prepare the compatible ACC v1.0.5 patch release

Compatibility

This change adds no ACC Core field, changes no declaration schema, and requires no declaration migration. Stateful cumulative controls remain in the authoritative business or policy layer.

Validation

• npm run check
• git diff --check
• npm pack --dry-run --json