feat(authz): export registry, store, engine, and middleware surface

Appends the Task 1-8 modules (defineAuthz, catalog merge helpers,
permission stores, audit sinks, resolver engine, and authzMiddleware/
can/guards) to the public @wrnexus/authz surface, and regenerates the
public-api-0.8.json baseline to match.

docs/public-api-0.8.json

@@ -457,11 +457,31 @@
     },
     "@wrnexus/authz": {
       ".": [
+        "AUTHZ_LOCALS_KEY",
+        "AttributeMeta",
         "AuthorizationDecision",
+        "AuthorizeDecisionOptions",
+        "AuthzAuditEvent",
+        "AuthzAuditSink",
+        "AuthzCatalog",
+        "AuthzModule",
+        "AuthzResolver",
+        "AuthzResolverOptions",
+        "AuthzScope",
+        "CacheOptions",
+        "CachedPermissionStore",
+        "CatalogSource",
+        "DecideInput",
         "DecisionPolicy",
+        "GrantEffect",
+        "GuardOptions",
+        "MemoryAuditSink",
+        "PermissionMeta",
+        "PermissionStore",
         "Policy",
         "Rbac",
         "Subject",
+        "SubjectAssignments",
         "all",
         "allDecisions",
         "allow",
@@ -470,14 +490,32 @@
         "attr",
         "authorize",
         "authorizeDecision",
+        "authzMiddleware",
+        "cachedPermissionStore",
+        "can",
+        "consoleAuditSink",
+        "createAuthzResolver",
+        "decideFor",
         "decision",
+        "defineAuthz",
         "defineRbac",
+        "deniedBy",
         "deny",
+        "emptyCatalog",
+        "expandRoles",
         "filterAuthorized",
+        "filterCan",
+        "guardPermission",
         "hasRole",
+        "memoryAuditSink",
+        "memoryPermissionStore",
+        "mergeCatalogs",
         "owner",
+        "permissionMatches",
         "requirePermission",
-        "requireRole"
+        "requireRole",
+        "safeRecord",
+        "scopeKey"
       ]
     },
     "@wrnexus/benchmark": {