integration: SAFA to SLIME public proof boundary

[AnathemaOfficial]

Summary

Bounded end-to-end integration proof demonstrating that the cleaned SAFA decision surface can hand off one action mapping to the cleaned public SLIME harness under explicit demo assumptions.

• 3 commits, 2 files, +358 lines
• docs/SAFA_SLIME_PUBLIC_PROOF.md — proof boundary doc (85 lines)
• safa-core/examples/slime_public_proof.rs — reproducible Rust example (273 lines)

What this proof claims

• SAFA ActionRequest parsing + validation
• SAFA action-to-domain mapping via demo fixture
• Handoff of (domain, magnitude) into SLIME public ingress
• One observed AUTHORIZED outcome + one IMPOSSIBLE outcome

What this proof does NOT claim

• Production readiness
• Enterprise/private AB-S integration
• Canonical-law completeness
• Semantic equivalence SAFA domains ↔ SLIME canon domains
• Unix socket deployment parity

Reproducible demo path

```powershell
cargo run -p safa-core --example slime_public_proof
```

Defaults to neighboring clone at `C:\Users\sebas\projects\slime-phase1b\SLIME\noncanon\implementation_bundle\slime-runner`. Override via `SLIME_RUNNER_DIR`.

Context

Consolidation of work done in a nested clone at `safa-phase1a/SAFA/` that was never pushed. Archived via this PR so the work survives cleanup of the nested checkout.

Test plan

• CI green on master
• Run proof locally: `cargo run -p safa-core --example slime_public_proof`
• Verify AUTHORIZED + IMPOSSIBLE outcomes
• Verify egress sink has exactly one 32-byte record