Add LLM tier and dossier primitives (LIP-0008)

[danvoulez]

Summary

Makes LIP-0008 representable in the constitutional-runtime type system. Does not implement LIP-0008. PR is intentionally Draft while LIP-0008 is Proposed.

This PR does not implement LIP-0008.
It makes LIP-0008 representable in the type system.

What's in

file	role
src/tier.rs	LlmTier (Mini/Operator/Translator/Frontier), GrammarKind (Operational/Strong/Dossier), GrammarKind::admits(&LlmTier) matrix
src/dossier.rs	Dossier, FrontierVerdict, DecisionRequest, Candidate, GhostRecord — the only admissible shape crossing the Frontier boundary
src/capability.rs	CapabilityManifest extended with allowed_ingress_tiers: Option<BTreeSet<LlmTier>> + allowed_grammars: Option<BTreeSet<GrammarKind>>
src/lib.rs	re-exports
tests/tier_admission.rs	exhaustive 3 × 4 matrix asserting GrammarKind::admits

Dossier reuses existing EvidenceRecord (from evidence.rs) and CostEnvelope (from capability.rs) — no duplication.

What's NOT in (intentional Gate 2 discipline)

• ✗ Admission enforcement — admission.rs is not modified
• ✗ Planning compiler / lowering changes
• ✗ Entropy policy
• ✗ Gateway / dispatch / Tower / LAB / receipt chain wiring
• ✗ Real LLM calls
• ✗ Pocket Runtime (lands in LogLine-Foundation/engine, separate PR)

This PR has exactly one talent: make the type exist. The lâmina fina.

Design note: Option<BTreeSet<_>>

The new fields are Option<BTreeSet<_>>, not BTreeSet<_>:

• None = legacy / unspecified — legacy manifests deserialize cleanly
• Some(empty) = explicit policy that allows nothing
• Some(set) = explicit policy

Later admission patches will treat these three cases differently. #[serde(skip_serializing_if = "Option::is_none")] keeps wire format clean for current manifests.

Test plan

• cargo check clean
• cargo test --lib → 141/141 pass (no regression)
• cargo test --tests → 1/1 (12 matrix assertions)
• cargo test --doc → 1/1 (GrammarKind::admits docstring)

Gates

Gate 0 — governance review     LIP-0008 published (governance#2, Proposed)
Gate 1 — consistency pass      clean (zero name collisions)
Gate 2 — this PR (Draft)       types representable
Gate 3 — admission enforcement future PR (depends on LIP-0008 Accepted)

🤖 Generated with Claude Code