Implement Stage A: rule engine, validation, audit, and safety gates

Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Presentation/Write-PersonaSummary.ps1

@@ -0,0 +1,82 @@
+function Write-PersonaSummary {
+    <#
+    .SYNOPSIS
+        Renders the rule-match table, outcome totals, and reconciliation result
+        (FR-019, FR-020, FR-021).
+
+    .DESCRIPTION
+        Emitted every summaryInterval users and once at completion.
+
+        Every business rule appears, including disabled rules and rules with zero
+        matches. A rule that never fired and a rule that is not in the configuration
+        look identical if zero-match rules are omitted, and the difference is exactly
+        what an operator investigating "why did nobody get classified as Tier0" needs
+        to see.
+
+        Reconciliation is displayed on every summary, not only when it fails. A check
+        that is only visible when broken gives an operator no reason to believe it
+        ran at all.
+
+    .PARAMETER Counters
+        The run counter set.
+
+    .PARAMETER SummaryType
+        Interim or Final. Final is emitted regardless of interval, including when
+        the interval is 0 (FR-020).
+
+    .PARAMETER Mode
+        Preview or Enforce, shown in the header so a screenshot of a summary is
+        self-describing.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        [object] $Counters,
+
+        [ValidateSet('Interim', 'Final')]
+        [string] $SummaryType = 'Interim',
+
+        [ValidateSet('Preview', 'Enforce')]
+        [string] $Mode = 'Preview'
+    )
+
+    $reconciled = Test-PersonaReconciliation -Counters $Counters
+
+    Write-Host ''
+    Write-Host ('=' * 100) -ForegroundColor DarkGray
+    Write-Host ("{0} summary - mode: {1} - processed: {2}" -f $SummaryType, $Mode, $Counters.Processed) -ForegroundColor Cyan
+    Write-Host ('=' * 100) -ForegroundColor DarkGray
+
+    Write-Host ('{0,-28} {1,-40} {2,-9} {3,10} {4,8}' -f 'Rule ID', 'Name', 'Priority', 'Enabled', 'Matches') -ForegroundColor DarkGray
+
+    foreach ($entry in $Counters.RuleCounts) {
+        # A disabled rule is dimmed rather than hidden: it is part of the
+        # configuration and its absence from the output would read as a deletion.
+        $colour = if (-not $entry.Enabled) { 'DarkGray' } elseif ($entry.Matches -gt 0) { 'Green' } else { 'Gray' }
+
+        Write-Host ('{0,-28} {1,-40} {2,-9} {3,10} {4,8}' -f
+            $entry.RuleId,
+            ($entry.Name.Length -gt 40 ? $entry.Name.Substring(0, 37) + '...' : $entry.Name),
+            $entry.Priority,
+            $entry.Enabled,
+            $entry.Matches) -ForegroundColor $colour
+    }
+
+    Write-Host ''
+    Write-Host ('Outcomes   Matched: {0}   Unclassified: {1}   EvaluationError: {2}' -f
+        $Counters.Matched, $Counters.Unclassified, $Counters.EvaluationError)
+    Write-Host ('Actions    Unchanged: {0}   WouldUpdate: {1}   Updated: {2}   UpdateFailed: {3}   Skipped: {4}' -f
+        $Counters.Unchanged, $Counters.WouldUpdate, $Counters.Updated, $Counters.UpdateFailed, $Counters.Skipped)
+
+    if ($reconciled) {
+        Write-Host ('Reconciliation  PASS  {0} = {1} + {2} + {3}' -f
+            $Counters.Processed, $Counters.Matched, $Counters.Unclassified, $Counters.EvaluationError) -ForegroundColor Green
+    }
+    else {
+        Write-Host ('Reconciliation  FAIL  {0} != {1} + {2} + {3}  - this is an engine defect (FR-021)' -f
+            $Counters.Processed, $Counters.Matched, $Counters.Unclassified, $Counters.EvaluationError) -ForegroundColor Red
+    }
+
+    Write-Host ('=' * 100) -ForegroundColor DarkGray
+    Write-Host ''
+}