Add control APIs, control-plane binary, and close the CLI gate bypass

Completes FLUID-WP-0004. The Revision and Intent APIs (Blueprint 44.1
and 44.5) are served by fluid-control, which is deliberately off the
request path and must never be reachable by interface consumers: it is
the mechanism that evolves the interface in response to their behaviour.

Intent amendment is a proposal, never an edit. Rewriting a recorded
version returns 409, because changing what a version says would change
what already-published revisions were governed by.

A rejected candidate comes back as 422 with its full stage report rather
than as a server fault. Rejection is a normal outcome (invariant 14) and
the reasons are the evidence a later hypothesis needs.

Also closes a real hole this workplan opened: `fluid revision publish`
previously wrote straight into the evidence store, which was a way
around the deterministic policy gate for anyone with shell access. It
now runs the same pipeline the control plane does and requires a signing
key.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014KmVxhJ35tCo7rE7UnLwWu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1116572@bnt-lap001
Assistant-Session: 8ba9bb93-a72a-4883-b189-2499cce5c400

cmd/fluid/flags.go

@@ -20,4 +20,7 @@ func (f *flagSet) Bool(name string, value bool, usage string) *bool {
 	return f.fs.Bool(name, value, usage)
 }
 func (f *flagSet) Int(name string, value int, usage string) *int { return f.fs.Int(name, value, usage) }
-func (f *flagSet) Parse(args []string) error                     { return f.fs.Parse(args) }
+func (f *flagSet) Float64(name string, value float64, usage string) *float64 {
+	return f.fs.Float64(name, value, usage)
+}
+func (f *flagSet) Parse(args []string) error { return f.fs.Parse(args) }