feat(protocol): add unified admission chain

[windoliver]

Summary

• Adds admission: contract/schema/docs support and normalizes legacy gates/hooks into admission rules.
• Runs the admission chain before contribution writes, attaches auditable admission metadata, and returns structured rejection details.
• Implements built-in validators for shell, metric, artifact/relation, blueprint hash, artifact signature, ReBAC, and governance checks, including Nexus-backed adapters.
• Hardens the TUI handoff harness so it can render real local Grove handoff state for tmux validation.

Closes #269.

Validation

• bun run typecheck
• bun --config=/tmp/grove-bunfig-no-coverage.toml test src/tui/views/handoffs-view.test.tsx src/tui/screens/running-view-handoffs.test.ts src/tui/screens/screen-manager.test.ts — 28 pass, 0 fail
• bun --config=/tmp/grove-bunfig-no-coverage.toml test src/core/admission src/core/contract.test.ts src/core/operations/contribute.test.ts src/nexus/nexus-admission-adapters.test.ts spec/schemas/grove-contract.test.ts tests/server/contributions.test.ts tests/server/boardroom.test.ts src/server/routes/shared.test.ts src/mcp/deps-parity.test.ts — 400 pass, 0 fail
• bun run build
• bun run check — exits 0; existing warnings only
• Pre-push hook reran typecheck and build
• Real local Grove smoke: tmux TUI and HTTP API both showed 2 handoffs, both replied, with 4 Codex/Claude loop contribution markers present