Add reusable IFC policy engine

[jmecom]

Adds buzz-ifc, a zero-I/O Rust library that implements the audience-, context-, agent-, and epoch-scoped policy from the secure agent information-flow design.

• Derives execution domains from verified Buzz facts and produces stable worker-routing keys.
• Enforces read, capability, process-reuse, confinement, publication, and exact declassification decisions.
• Validates Nostr principals as x-only secp256k1 points and fails closed across realms, contexts, unknown provenance, and reused processes.

This intentionally does not integrate with ACP, the relay, Desktop, or a broker executable. The trusted broker can consume the library while retaining responsibility for verifying events and membership and for durable declassification expiry/replay enforcement.

Checked with just ci, targeted cargo test -p buzz-ifc, Clippy with warnings denied, and rustdoc with warnings denied.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2f66ee24a0bf5efa958378069a6b155e99a1d068...4c2de983fcd8a7aa1c1f71629dcd873332d665d2.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 4c2de983fcd8a7aa1c1f71629dcd873332d665d2 to authorize a new review.
Any previous review applies only to its recorded range.