feat(authz): export registry, store, engine, and middleware surface

Appends the Task 1-8 modules (defineAuthz, catalog merge helpers,
permission stores, audit sinks, resolver engine, and authzMiddleware/
can/guards) to the public @wrnexus/authz surface, and regenerates the
public-api-0.8.json baseline to match.

packages/authz/src/index.ts

@@ -140,3 +140,30 @@ export {
   filterAuthorized,
 } from "./advanced.ts";
 export type { AuthorizationDecision, DecisionPolicy } from "./advanced.ts";
+export { defineAuthz } from "./registry.ts";
+export { mergeCatalogs, emptyCatalog } from "./catalog.ts";
+export type { CatalogSource } from "./catalog.ts";
+export { memoryPermissionStore, cachedPermissionStore, scopeKey } from "./store.ts";
+export type { PermissionStore, CachedPermissionStore, CacheOptions, GrantEffect } from "./store.ts";
+export { memoryAuditSink, consoleAuditSink, safeRecord } from "./audit.ts";
+export type { AuthzAuditEvent, AuthzAuditSink, MemoryAuditSink } from "./audit.ts";
+export { createAuthzResolver, expandRoles, permissionMatches, deniedBy } from "./engine.ts";
+export type { AuthzResolver, AuthzResolverOptions, DecideInput } from "./engine.ts";
+export {
+  authzMiddleware,
+  can,
+  decideFor,
+  guardPermission,
+  filterCan,
+  AUTHZ_LOCALS_KEY,
+} from "./middleware.ts";
+export type { GuardOptions } from "./middleware.ts";
+export type {
+  AuthzScope,
+  AuthzCatalog,
+  AuthzModule,
+  AttributeMeta,
+  PermissionMeta,
+  SubjectAssignments,
+} from "./types.ts";
+export type { AuthorizeDecisionOptions } from "./advanced.ts";