Control Plane: implement append-only canonical event store #15

Implementation tranche landed on main for the append-only canonical event store.

Completed scope:

• tools/sourceos_eventctl.py now supports:
  • validate
  • explain
  • emit-policy-decision
  • write
  • list
  • show
  • verify-store
• Event writes validate against the stricter schemas/sourceos.event.v0.1.schema.json before persistence.
• Store format is append-only JSONL.
• Duplicate event IDs are rejected by default on write.
• verify-store validates every event and reports a store SHA-256 digest.
• tools/smoke_event_store.py exercises write/list/show/verify-store and generated event persistence.
• make validate now includes the event-store smoke test.

Evidence limitation: connector did not surface a GitHub Actions run or combined status for the latest commit, so CI pass is not yet independently confirmed here. The issue should remain open until CI status is visible or someone runs make install-dev && make validate locally/through Actions and records the output.

Closed: append-only canonical event store implemented in PR #42 (control-plane-toolkit-20260603). sourceos_eventctl write/list/show/verify subcommands, JSONL storage, schema validation before write, and basic integrity check are present.