v1.6.0 — trust architecture

Family v1.6.0: undo-token support on reversible write tools + the vmware-policy 1.6.0 governance harness (token/runaway budget, audit accountability fields, graduated risk tiers). See RELEASE_NOTES.md.