Rust engine v0.1.30

Rust engine v0.1.30 delivers JANUS-450 and JANUS-452: runtime-authority denials are now diagnosable end to end.

identityd (JANUS-450). Every runtime-authority denial is answered with its specific value-free reason code (for example subject_not_enrolled, runtime_authority_request_context_mismatch) instead of the generic runtime_authority_request_denied, and every denial is audited in JANUS_RUNTIME_AUTHORITY_AUDIT_FILE as outcome:"denied" with that code — never a UID, PID, path, or value. Frames that never become a request are audited as runtime_authority_request_invalid. The startup precondition runtime_authority_config_invalid is split into runtime_authority_audience_invalid, runtime_authority_ttl_invalid, runtime_authority_release_digest_invalid, and runtime_authority_manifest_fingerprint_mismatch; janusd-identityd prints reason_code=… value_returned=false on every startup failure.

Clients (JANUS-452). Warden, janusd, and every runtime-authority client distinguish runtime_authority_unavailable (broker unreachable or client configuration incomplete), runtime_authority_reply_invalid, and runtime_authority_denied, the last carrying the broker's own token-sanitized code as broker_reason_code. Warden structured errors expose both fields.

Operators. The first allowed audit line for a freshly enrolled subject is the enrollment proof; an empty registry denies by design. The reason-code table lives in docs/runtime-accountability-runbook.md § Reason codes and denial evidence. Bare containers without a configured broker now report runtime_authority_unavailable (previously runtime_authority_denied).

Feature + version PR: #87
Tickets: JANUS-450, JANUS-452 (context: JANUS-442, NIX-377)