feat: port arbor, dharma, forge El source into monorepo

Brings the remaining foundation repos that were not included in the
original monorepo consolidation:

- arbor/vessels/ — 6 vessels (arbor-cli, arbor-core, arbor-diagram,
  arbor-layout, arbor-parse, arbor-render) with manifests + src/main.el
- dharma/ — CGI Provenance Registry package (flat layout, 14 .el files
  across registry/, sandbox/, training/, validation/, tests/)
- forge/ — consciousness channel tool (8 src .el files + new manifest.el)
- elp/src/ — 36 test fixture files not carried over in original merge
  (dedup_*, realizer_*, semantics_*, morph_*, ext_*, one_extern_* helpers)

el-ide, engram, elql are already complete in ide/, engram/, ql/.

dharma/auth.el

@@ -0,0 +1,24 @@
+// auth.el — Request authentication for DHARMA.
+//
+// Supports API key auth via X-Dharma-Key header.
+// The API key is loaded from DHARMA_API_KEY env var.
+//
+// Headers are exposed via state_get("__header_<lowercase-name>__") —
+// this requires the El runtime to store request headers in GLOBAL_STATE
+// before invoking handle_request (patched in main.rs).
+
+// check_auth returns true if the request carries a valid DHARMA_API_KEY.
+// The X-Dharma-Key header is read from state_get("__header_x-dharma-key__").
+fn check_auth() -> Bool {
+    let required_key: String = env("DHARMA_API_KEY")
+    if str_eq(required_key, "") {
+        // No key configured — open access (development mode)
+        return true
+    }
+    let provided_key: String = state_get("__header_x-dharma-key__")
+    return str_eq(provided_key, required_key)
+}
+
+fn unauthorized() -> String {
+    return "{\"error\":\"unauthorized\"}"
+}