Publish capability: core.ttl-expiry-decide (retention TTL / expiry decision)

## Why

`retention.eligibility-classify` answers hold/retain/eligible from dependency + legal/review holds. Separately, runtimes need a **TTL/expiry decision**: given `created_at`/`expires_at`/`ttl_seconds` and `now`, is the record active, expiring-soon, or expired — for caches, sessions, offers, and retention clocks. Pure decision; no deletes.

## One-PR ask

Publish **`core.ttl-expiry-decide@1.0.0`**:

**Inputs:**
- `record`: `{ "id": string, "created_at"?: string (ISO-8601), "expires_at"?: string, "ttl_seconds"?: integer }` — require enough fields to compute expiry (document precedence: `expires_at` wins over `created_at+ttl_seconds`)
- `now`: string (ISO-8601)
- `soon_window_seconds?`: integer ≥ 0 (default e.g. 86400)
- `policy_version`: string

**Outputs:**
- `record_id`: string
- `state`: `active` | `expiring_soon` | `expired` | `unknown`
- `expires_at`: string | null
- `seconds_remaining`: integer | null
- `reason_code`: string
- `policy_version`: string
- `ok`: boolean

**Behavior:** Deterministic time math. Missing insufficient timing fields → `unknown` + `ok: false` (fail closed). Do not delete or mutate storage.

Follow [`CONTRIBUTING.md`](https://github.com/traverse-framework/registry/blob/main/CONTRIBUTING.md) and [`capabilities/README.md`](https://github.com/traverse-framework/registry/blob/main/capabilities/README.md) publish checklist.

- Include `capability-src/` with real Rust tests meeting registry coverage gates (`functions` 100%, lines/regions ≥ 95%)
- Use `traverse-cli capability publish` (or the documented scaffold) so `artifact.digest` / `artifact.url` survive
- Declare `authoring.method` (`human` or `llm-assisted`)
- Ensure every `use_cases[].persona_ref` resolves (scaffold personas if needed)
- Run `bash scripts/ci/pre_pr_check.sh ` before opening
- One capability per PR; branch from `origin/main`, not another `publish/*` branch

**Apps are not ready — publish the capability only.** No app wiring, no demo product surface.

## Out of scope

- Overlap rewrite of `retention.eligibility-classify` (no legal_hold / reference_count logic)
- Performing deletes / GC
- Cron schedulers

## Done when

- CI green; published in next index
- Tests: active, expiring_soon, expired, precedence expires_at vs ttl, insufficient fields fail closed
- Description distinguishes from `retention.eligibility-classify`

## Host / deps notes

**Pure WASM.** Caller supplies `now`. No host clock, no connector, no network. Namespace `core` (do not add a new topic namespace).

## Labels

`help wanted` · `good first issue` · `enhancement` · `no-spec-needed`

Read CONTRIBUTING.md and capabilities/README.md first, then use the documented scaffold to inspect the required capability layout and capability-src/ Rust tests. Run the tests for active, expiring_soon, expired, precedence, and fail-closed cases, then use traverse-cli capability publish and bash scripts/ci/pre_pr_check.sh . Done means the capability publishes with preserved artifact metadata and all checklist requirements pass.

Written by the indexing model from the issue text.