#163: Persist passive auth summary artifacts

[justsml]

Stacked on #162 and split from #21 and the former combined PR #150.

Closes #163

Scope

• Build concise auth-surface summaries from normalized evidence.
• Persist and index reports through the canonical artifact/RAG pipeline with source passive-recon.
• Preserve raw artifact attribution, blockers, unknowns, confidence, and categorized next steps.

Merge order

Merge #162 first, then retarget this PR to main and merge with a merge commit.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Add retry-safe report idempotency/exactly-once Artifact+RAG behavior before exposing persistence. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.

[justsml]

Superseded by the merged passive-auth implementation in #150 and its follow-up launch-blocker PRs. Closing this obsolete stacked branch to avoid duplicate work.