Publish capability: core.consent-purpose-check (consent / purpose binding check)

## Why

Agents that process personal data need a **purpose-binding check**: given recorded consents and a requested processing purpose, is the action allowed? This is business/governance logic, not a string util — capability decides, agent does not invent legal conclusions.

## One-PR ask

Publish **`core.consent-purpose-check@1.0.0`**:

**Inputs:**
- `subject_id`: string
- `requested_purpose`: string (from a closed enum or caller-supplied catalog ids)
- `consents`: array of `{ "purpose": string, "status": "granted"|"denied"|"withdrawn", "granted_at"?: string (ISO-8601), "expires_at"?: string | null, "scope"?: string[] }`
- `now`: string (ISO-8601) — caller-supplied clock (pure; no ambient time)
- `policy_version`: string

**Outputs:**
- `decision`: `allow` | `deny`
- `reason_code`: e.g. `consent_granted` | `consent_withdrawn` | `consent_expired` | `purpose_not_granted` | `invalid_input`
- `matched_consent_index`: integer | null
- `policy_version`: string

**Behavior:** Exact purpose match (document whether scope must also intersect). Withdrawn/expired/denied → deny. No consent row → deny (fail closed). Invalid timestamps → fail closed.

Follow [`CONTRIBUTING.md`](https://github.com/traverse-framework/registry/blob/main/CONTRIBUTING.md) and [`capabilities/README.md`](https://github.com/traverse-framework/registry/blob/main/capabilities/README.md) publish checklist.

- Include `capability-src/` with real Rust tests meeting registry coverage gates (`functions` 100%, lines/regions ≥ 95%)
- Use `traverse-cli capability publish` (or the documented scaffold) so `artifact.digest` / `artifact.url` survive
- Declare `authoring.method` (`human` or `llm-assisted`)
- Ensure every `use_cases[].persona_ref` resolves (scaffold personas if needed)
- Run `bash scripts/ci/pre_pr_check.sh ` before opening
- One capability per PR; branch from `origin/main`, not another `publish/*` branch

**Apps are not ready — publish the capability only.** No app wiring, no demo product surface.

## Out of scope

- Legal advice / jurisdiction engines
- Storing consents (caller/host owns store)
- Cookie banner UIs

## Done when

- CI green; published in next index
- Tests: granted allow, withdrawn deny, expired deny, missing deny, bad timestamp fail closed

## Host / deps notes

**Pure WASM.** Caller supplies `now` and consent rows — no host clock, no network, no connector.

## Labels

`help wanted` · `good first issue` · `enhancement` · `no-spec-needed`