[CA-01-S3] Expose trusted-host causal-anchor admission

[flyingrobots]

Goal

Allow an application to request a causal anchor through Echo's trusted runtime authority.

Acceptance criteria

• TrustedRuntimeApp exposes an application-requested admission API that requires an enabled runtime WAL.
• Echo derives the admission receipt and canonical anchor; callers cannot confer Echo authority.
• The request is validated against a named durable causal basis and generic root-support policy before append.
• The method returns only after the WAL commit succeeds.
• Restart recovery can find the admitted anchor and receipt by anchor id.
• Invalid support, stale basis, and storage failure produce typed errors without publication.

[coderabbitai]

🔗 Related PRs

#379 - feat(core): commit runtime WAL ACK evidence [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Implemented in 9846104. TrustedRuntimeApp now validates the current durable basis and host-owned root-support policy, commits through the enabled runtime WAL, returns typed failures without publication, and recovers admitted evidence by opaque anchor id after restart.