feat: prove approvals without exposing private audit data

[renezander030]

Value

A customer or auditor can verify that a direct human approval met quorum without receiving the customer payload, reviewer identity, workflow name, timestamp, or vote counts.

What ships

• draftcat zk-receipt key-id|prove|verify
• BN254/Groth16 circuit with only key and receipt commitments public
• HMAC validation before proving; policy approvals, altered rows, and under-quorum rows are refused
• pinned instance-key verification and circuit-ID binding
• prominent beginner-facing README explanation plus full threat model
• embedded development proving artifacts and regeneration command

Evidence

• go test ./...
• go vet ./...
• end-to-end SQLite -> signed row -> 164-byte proof -> pinned-key verification
• negative tests for policy approval, insufficient quorum, wrong key, hidden-field leakage, and tampered commitment
• focused local proof: 29 ms on this machine

Review boundary

This is explicitly labeled an experimental preview. The checked-in Groth16 keys come from a single-party development setup and the circuit has not been independently audited. The docs require a multiparty ceremony or suitable transparent system plus an audit before production reliance.