v0.5 - grounded compliance citations

Verified verbatim regulatory spans per compliance claim (quote -> substring-
verify -> drop hallucinated), on the Gemini spine. Plus the MCP week:
agent-as-client/server over stdio, multi-framework rule packs, a raw-stdio
test client, and the compliance audit trail.