049-admission-dry-run

An admission dry-run evaluates a policy through the closed evaluator and writes nothing

Adds a verb that evaluates a revision's recorded verdicts and decisions against an admission policy through spec 037's closed evaluator and answers what admission would decide, with the same refusal codes in the same order, without writing an attestation, a record or any state. Beside the decision it reports every check's own result, so an operator previewing a policy change sees which requirements allowed and were overruled by a deny. The policy-eval/v1 claim is unchanged; whether that trace should ever enter the claim is an owner question.