feat: harden mediation, add state triggers/query, and enforce status consistency

[AlexU-A]

Summary:\n- harden mediation auth/router with fail-closed behavior and tighter session scoping\n- add mediation auth middleware integration tests\n- add joyus-ai-state query_snapshots MCP tool\n- add custom config-driven file event triggers for snapshot capture\n- add canonical status registry, generator/verifier scripts, and CI status-consistency workflow\n- update README and ROADMAP to reference canonical status artifacts\n\nValidation:\n- status consistency verifier passes\n- spec governance check in joyus-ai passes\n- targeted tests passed in development worktree before branch cut

[AlexU-A]

Code Review: PR #2 — Mediation Hardening + Status Consistency

Reviewed the full diff. Summary:

Security (auth.ts + router.ts) — Solid

• Fail-closed on DB errors: catch block returns 503. Correct pattern.
• Session context matching: sessionMatchesRequestContext() checks userId + tenantId + apiKeyId. Closes cross-tenant session access vector.
• JWT subject validation: Validates payload.sub is non-empty string.
• Structured logging with request IDs, tenant context, durations.

Testing — Good Coverage (269 lines)

Covers: missing/invalid API key, fail-closed on DB unavailability, valid key context, missing bearer token, expired token, valid token, session context matching.

State Schema

customTriggers changed from string[] to CustomTriggerSchema. Breaking but acceptable pre-production.

Status Consistency + Gitleaks

Clean canonical status approach. Gitleaks switched to direct CLI.

No blocking issues found. Ready for CODEOWNER merge.