Document v0.3 consumer authorization

[Aaronontheweb]

Summary

• replace the stale pre-alpha Clauses authorization example with an all-occurrence Commands loop
• separate Syntax display traversal from authorization and document bounded values, joined cwd, redirects, incomplete results, and unknown enums
• document v0.2 compatibility, record/serialization effects, and the v0.3.x Clauses support horizon in the guide and release notes
• update the README quick start as diagnostic-only and close OpenSpec tasks 5.1-5.5

The authorization example evaluates every occurrence and aggregates Deny > Prompt > Allow; it does not let an early prompt hide a later hard deny.

Validation

• dotnet build -c Release (0 warnings)
• dotnet test -c Release --no-build (2,370 passed)
• dotnet pack -c Release -o ./bin/nuget
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• openspec validate v0-3-structured-shell-analysis
• git diff --check
• adversarial security review: PASS