C3: compliance menu + the scout-results admission handler

[eaitbrahim]

Per the PRD §5 C3 + O6: the Compliance menu (screen, propose, attest [typed], attest-instrument, exempt/unexempt, holdings, discover, subscription, withdrawals attest [typed], purification) — and the scout-results handler: list the keel-asset-scout proposals (operator-local path via config, clear empty state) and drive the EXISTING admission flow propose → screen → human-typed attest → allowlist via keel/commands/admission.py. Never auto-attests; never writes outside supported service paths. Acceptance: a real proposal file driven end-to-end in paper through the console.

[eaitbrahim]

Scope addition (2026-08-19, operator): the 'Shariah in force' browser (PRD O10). A Compliance submenu showing, for the ACTIVE profile, what the engine enforces right now — read-only, rendered from existing records/documents, never re-deriving: per-instrument attestations in force over the active allowlist (attributed source, ruling, date — the assets list data through its service) plus documented exemptions; the fiqh-derived constraints the rails encode, each with its plain-English explanation and citation into docs/fiqh-basis.md; and the standing honesty lines ('keel is not a fatwa engine', 'no scholarly review has occurred') always visible. The help menu explains the vocabulary (qabd, riba, gharar, maysir, attestation, exemption, purification) anchored to fiqh-basis.md so definitions cannot drift. Success criterion 9 pins it.

[eaitbrahim]

C3 complete — merged in PR #403 (adversarially reviewed: the typed-contract core survived the attack — every write path phrase-gated, scout can never auto-attest, attestation keying matches the gate's own reads; 3 majors + 5 minors + 3 nits fixed pre-merge, including a real pre-existing crash the new ARMED tests flushed out: the compliance discover path fed a DiscoverReport to render_discover — now calls the CLI's own run_discovery sweep).

The Compliance menu dispatches every entry to existing services (screen/propose/attest/attest-instrument/exempt/unexempt/holdings/discover/subscription/purification); attest ends typed (type the asset code back, exact case — stricter than before), withdrawals attest runs the CLI's own interactive gate in-console via curses suspend/restore, fail-closed. The scout handler lists the proposals dir from config (empty state honest), renders read-only (bounded 1 MiB reads, mtime-cached views), and drives propose → screen → human-typed attest — never auto-attesting. The Shariah-in-force browser shows the active profile's attestations-in-force (keyed exactly as the gate reads them), exemptions, the five fiqh constraints as verbatim fiqh-basis quotes with resolving citations, and the two honesty lines PINNED outside the scroll (always on screen, tested at offset 0 and max). The help overlay's old 'attest is CLI-only' safety claim — now false — was rewritten to state the real contract everywhere.

New service-layer reads: admission.list_shortlists, assets.gather_attestations_in_force, three extracted subscription functions (CLI delegates, byte-compatible). Gates: 3399 passed, 3 skipped; ruff/mypy clean.