v0.3.0 -- A confirmation must carry the value

Two more gaps found by Aegis Vector's poisoning battery, closed the same way as v0.2.0: without giving up the rules themselves.

What changed:

• A confirmation must carry the value (consult.py). In an ATTRIBUTE domain the value is the claim. A new claim that shared a fact's wording but stated no figure ("the limit has been removed" against "the limit is $10,000") used to count as reinforcement. Now it gets the new relation UNCONFIRMED: no weight, no evidence, a COEXISTS edge marked REVIEW_NEEDED, and a place in pending_reviews(). The same holds for an exception that drops its rule's figure ("for this project, any amount"): still a SCOPE_LINK, never a collision, now marked for review.
• Optional adjudicator (consult(store, candidate, adjudicator=...), palimpsest/adjudicate.py). Token overlap and quantities can't read meaning; a model can, but a model can also be persuaded by a well-written forgery. So it gets one rule: it may raise a flag, never lower one. It is consulted only on reinforcements and items marked for review. "contradicts" turns a reinforcement or an unconfirmed claim into an open collision, and is recorded on an exception, which never collides. "agrees" and "unrelated" change nothing but are recorded on the edge. An adjudicator that errors or answers outside those three verdicts changes nothing. adjudicate.py provides a local Ollama adjudicator using only the standard library; its default, qwen2.5:3b, and phi4-mini both classified a small set of reference cases correctly, while llama3.2 leaned toward "agrees".

Behavior change: an exception that states no figure, against a rule that has one, is now marked for review even when it's harmless. That's deliberate: without reading meaning, it can't be told apart from "for this project, any amount". The trade is fewer silent passes for more items a person looks at.

Measured, not claimed: in Aegis Vector's defenses battery (five small local models, nine forged payloads, four questions each), Palimpsest as an ingestion gate quarantined all nine, including two that state no number at all. One of those copies the employees' questions so the retriever can't miss it: 70% of answers adopted it with no defense and 70% with a grounding check (there's no figure to check), and stacking provenance labels, spotlighting, and a perplexity filter only got it to 20%. The gate held it to 0%. Run beside the gate, the qwen2.5:3b adjudicator answered "contradicts" for all nine; every payload was already held, so it changed nothing there. The scenario is narrow: forged values for registered facts.

86 tests, all passing. store.py's Elasticsearch backend is still unverified against a live cluster, and collision resolution is still scripted.