feat(mgtp): deterministic decision artefact demo with golden replay test

[Copilot]

Adds a minimal, regulator-readable demonstration that MGTP DecisionRecord serialisation is deterministic, hash-stable, and replayable. No upstream modules modified.

Changes

• mgtp/types.py — New DecisionRecord frozen dataclass; canonical_bytes() (sorted-key JSON, UTF-8) and decision_hash() (sha256 hex) methods; stdlib only
• examples/minimal_decision_demo.py — Fixed-input script printing canonical_bytes (base64), decision_hash, and verdict; no randomness, no clock
• tests/golden/decision_golden.b64 — Precomputed base64 canonical bytes anchor fixture
• tests/test_mgtp_replay.py — Three assertions: live bytes == golden bytes, live hash == sha256(golden bytes), replayed hash == live hash; any byte drift fails
• README.md — "Deterministic Decision Artefact Demo" section: input table, base64 snippet, hash value, reproduce commands
• .github/workflows/ci.yml — Runs python examples/minimal_decision_demo.py as a check step
• .gitignore — Excludes __pycache__ and build artifacts

Example

from mgtp.types import DecisionRecord
import base64

record = DecisionRecord(
    transition_id="txn-0001", risk_class="LOW", irreversible=False,
    resource_identifier="res://demo/alpha", trust_boundary_crossed=False,
    override_token=None, timestamp="2026-01-01T00:00:00Z",
    actor_id="demo-actor", authority_basis="OWNER", tenant_id="tenant-001",
    verdict="APPROVED",
)

print(base64.b64encode(record.canonical_bytes()).decode())
# eyJhY3Rvcl9pZCI6ImRlbW8tYWN0b3IiLC...
print(record.decision_hash())
# 8523083fc724b22f80fb638a2518133bf03f8c3283fbe7a0f629e04da5e01200

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.