posture: read-only live posture report GET /v2/posture (P3-POSTURE)

[zachyking]

Problem

XV-14 (P3-POSTURE): whether a running averin is keyed, durable, on a real signing seed and running with AVERIN_REQUIRE_PROD_SECRETS could only be read from files. The decision core (Rust staticlib) also carries no version, so which rustc built the trust root of a running server was unknowable.

Fix / Proof

GET /v2/posture?project=<p>, under the ordinary project API-key auth (401 without the project's bearer on a keyed deployment; on an unauthenticated deployment it answers anyone and reports api_keys_configured: false, which is the violation). Reports: keyed or not (an explicit open store counts as not keyed), Postgres wired, signing seed is the committed dev seed, AVERIN_REQUIRE_PROD_SECRETS, the two authority-pin switches, Go toolchain, git commit, clean tree, and core_rustc: the rustc that built the linked staticlib, stamped at link time with -ldflags "-X 'main.coreRustc=<rustc --version>'" by feir-os's build-all.sh (an unstamped build reports none and the verifier treats that as a violation). Booleans and build identifiers only. The Rust core is NOT touched (no change under core/, no FFI change), so no trust-root claim moves.
Kit claim posture-report-live (server gate) with a legacy-register entry, three drift-locked symbols (handlePosture, buildInfoPosture, main), four semantic mutants, and a test that builds the real averin-server and reads the report from the live process (keyed in-memory deployment, the build stamp reaching the report, the dev seed reported as such). docs/dev/API.md documents the route.

Red-first / bite evidence

Tests written against the missing route (404) before the handler. Mutants, all killed by check_mutants.py --only: posture-keys-always-reported, posture-pin-switch-hardcoded, posture-core-rustc-dropped, posture-dev-seed-not-reported. The mutant detector builds the staticlib into the kit's private cargo target dir and links it through a symlink.

Gates run

go vet ./cmd/averin-server ./internal/api, the new api and live-process tests, python3 scripts/check-claims.py (legacy register), python3 scripts/formal/check_claims.py --claims formal/kit-claims.json (0 failures), unit tests of the checkers, check_mutants.py per new mutant; full go test ./... in server/ (see the comment on this PR for the final run). Four-plane e2e (govder TestFourPlanePostureE2E) reads this endpoint from the real binary.

What this does NOT establish

The live-process test cannot start with AVERIN_REQUIRE_PROD_SECRETS=1 (that gate needs a Postgres URL), so that flag and durable_store=true are covered by the handler test with a hand-built Posture, not by a running binary. The rustc stamp is whatever the build script passed; the staticlib has no version of its own. The report says what was configured, not that the database is reachable or the keys are strong.
Merge order: independent of vultrino and leria, then feir-os, then govder last.

[zachyking]

Real-binary evidence: the armed four-plane e2e (govder run 38193678632, built from the five formal/p3-posture branches) reads this endpoint from the real process in TestFourPlanePostureE2E and feeds all six reports to the feir-os verifier; the e2e job concluded success. See FeirAI/govder#25.