Publish capability: core.eligibility-check (deterministic rule-table eligibility)

## Why

Business flows (offers, benefits, feature flags, program enrollment) need a **deterministic eligibility decision** from a caller-supplied rule table — not free-form agent judgment. Closest existing cap is `retention.eligibility-classify` (asset retention holds), which is a different domain. We need a general **program/offer eligibility** helper so agents propose, capability decides.

## One-PR ask

Publish **`core.eligibility-check@1.0.0`**:

**Inputs:**
- `subject`: object with declared attributes (e.g. `{ "id", "attributes": { ... } }` — keep schema tight; document allowed attribute value types: string/number/boolean)
- `rules`: ordered array of `{ "id", "when": { "all"?: AttrPred[], "any"?: AttrPred[] }, "result": "eligible"|"ineligible"|"manual_review", "reason_code": string }`
- `AttrPred`: `{ "attr": string, "op": "eq"|"neq"|"gte"|"lte"|"in"|"exists", "value"?: ... }`
- `policy_version`: string
- Default: first matching rule wins; if none match → `ineligible` with `reason_code: no_rule_matched` (fail closed)

**Outputs:**
- `decision`: `eligible` | `ineligible` | `manual_review`
- `matched_rule_id`: string | null
- `reason_code`: string
- `policy_version`: string
- `evaluation_trace`: string[] (short, deterministic)

**Behavior:** Pure rule evaluation. No network. Invalid rule table → error/`ok: false` fail closed.

Follow [`CONTRIBUTING.md`](https://github.com/traverse-framework/registry/blob/main/CONTRIBUTING.md) and [`capabilities/README.md`](https://github.com/traverse-framework/registry/blob/main/capabilities/README.md) publish checklist.

- Include `capability-src/` with real Rust tests meeting registry coverage gates (`functions` 100%, lines/regions ≥ 95%)
- Use `traverse-cli capability publish` (or the documented scaffold) so `artifact.digest` / `artifact.url` survive
- Declare `authoring.method` (`human` or `llm-assisted`)
- Ensure every `use_cases[].persona_ref` resolves (scaffold personas if needed)
- Run `bash scripts/ci/pre_pr_check.sh ` before opening
- One capability per PR; branch from `origin/main`, not another `publish/*` branch

**Apps are not ready — publish the capability only.** No app wiring, no demo product surface.

## Out of scope

- Replacing or extending `retention.eligibility-classify`
- ML scoring, fuzzy matching, or free-text interpretation
- Persisting eligibility decisions
- Apps / UI

## Done when

- CI green; published in next index
- Tests: match first rule, no-match fail closed, gte/in/exists ops, invalid rules rejected
- Distinct from retention eligibility in `description` / `use_cases`

## Host / deps notes

**Pure WASM.** No connector, no host state, no model.

## Labels

`help wanted` · `good first issue` · `enhancement` · `no-spec-needed`

Start with CONTRIBUTING.md and capabilities/README.md, then inspect the documented scaffold and existing capability-src/ examples. Run the Rust tests and bash scripts/ci/pre_pr_check.sh ; use traverse-cli capability publish as documented. Done means the rule-table behavior and coverage requirements pass, metadata references resolve, and the published artifact retains its digest and URL.

Written by the indexing model from the issue text.