feat(p9): CMP consent gate in the Capability Broker

Task S2.1: the broker now checks consent (cmp.checkPurpose) after the OPA gate +
obligations and before the provider — a DENY blocks the send (BLOCKED/CONSENT_DENIED,
provider never called); ALLOW/NOT_REQUIRED proceed, ALLOW carrying the consent
receipt. Contracts gain CapabilityRequest.purpose + CapabilityResult.consentReceiptRef.
FakeCmp is now purpose-aware (denyPurpose/allowOnly). 5 new tests: allow+receipt,
deny→blocked, not-required, purpose-aware, OPA-before-CMP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-contracts/src/capability.ts

@@ -22,6 +22,8 @@ export interface CapabilityRequest {
   target: string;
   payload: Record<string, unknown>;
   idempotencyKey: string;
+  /** CMP purpose code for the consent check (e.g. 'outbound_message', 'marketing'). */
+  purpose?: string;
   dataClass?: DataClass;
 }
 
@@ -30,6 +32,8 @@ export interface CapabilityResult {
   outcome: CapabilityOutcome;
   errorCode?: string;
   latencyMs?: number;
+  /** The CMP consent receipt this egress went out under (provenance). */
+  consentReceiptRef?: string;
 }
 
 /** What a provider reports; the broker normalizes `outcome` into CapabilityResult. */