research(arch): hosted / user-deployed proxy — server-client mode #354

A Tirith server that thin CI clients call: centralised policy source, cached verdicts, no
per-runner install. Overlaps platform check (the hosted case is the platform) and plan
attestation. The question to answer first is the OSS/paid boundary; #165 (client-server
architecture) is the prior-art thread.