Implement Stage A: rule engine, validation, audit, and safety gates

Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PersonaEngine.psd1

@@ -0,0 +1,75 @@
+@{
+    RootModule        = 'PersonaEngine.psm1'
+    ModuleVersion     = '0.1.0'
+    GUID              = 'b3f1c2d4-5e6a-47b8-9c0d-1e2f3a4b5c6d'
+    Author            = 'Persona Engine maintainers'
+    Description       = 'Deterministic, configuration-driven identity classification for Microsoft Entra ID user objects.'
+
+    # PS 7.2 floor rather than 7.4: the Azure Automation runtime version is
+    # unverified until Stage B (research.md V-5b). Do not raise without evidence.
+    PowerShellVersion = '7.2'
+
+    # OTD-004: authentication and Invoke-MgGraphRequest only. No resource-specific
+    # Graph SDK modules — keeping the Automation import surface to one module.
+    RequiredModules   = @('Microsoft.Graph.Authentication')
+
+    FunctionsToExport = @(
+        # Configuration
+        'Import-PersonaConfiguration'
+        'Test-PersonaConfiguration'
+        'Test-PersonaConfigurationSemantic'
+        'Test-PersonaConfigurationSafety'
+        'Write-PersonaValidationFinding'
+        'Resolve-TargetAttribute'
+        'Get-PersonaRequiredFacets'
+        'New-PersonaValidationFinding'
+        # Normalization
+        'New-PersonaUserRecord'
+        'New-PersonaMembershipRecord'
+        'ConvertTo-PersonaUserRecord'
+        'ConvertTo-PersonaMembershipRecord'
+        # Rule engine
+        'Test-PersonaCondition'
+        'Test-PersonaConditionGroup'
+        'Test-PersonaRule'
+        'Resolve-UserPersona'
+        # Authentication and data providers
+        'Connect-PersonaGraphInteractive'
+        'Invoke-PersonaGraphRequest'
+        'Get-PersonaUsers'
+        'Get-PersonaRequiredProperties'
+        'Get-PersonaGroupMembership'
+        'Get-PersonaDirectoryRoles'
+        'New-PersonaDataCache'
+        'Get-PersonaCachedMembership'
+        # Persistence
+        'Compare-PersonaValue'
+        'New-PersonaWriteBody'
+        'Set-UserPersonaAttribute'
+        # Presentation
+        'Write-UserPersonaResult'
+        'Write-PersonaSummary'
+        'New-PersonaRunCounter'
+        'Add-PersonaRunResult'
+        'Test-PersonaReconciliation'
+        'Get-PersonaReconciliationDetail'
+        # Audit
+        'New-PersonaAuditContext'
+        'New-PersonaAuditRecord'
+        'Write-PersonaAuditRecord'
+        'New-PersonaAuditSinkState'
+        'Export-PersonaRunReport'
+        # Run loop
+        'Invoke-PersonaEngineRun'
+    )
+    CmdletsToExport   = @()
+    VariablesToExport = @()
+    AliasesToExport   = @()
+
+    PrivateData       = @{
+        PSData = @{
+            Tags       = @('Entra', 'Identity', 'Classification')
+            ProjectUri = ''
+        }
+    }
+}