feat(spec): build out System layer and element schema model

Picture the whole framework, then pin the element-kind language layer.

System platform layer — rebuild the semantics likec4 can't draw (ADR-0001..0004):
- Prelude: opaque Identifiers carrier (ProjectId/RunId/SessionId/Principal)
- System/Run: RunState + Terminal subset (set completeness left OPEN, no invented pending)
- System/Lock: lock owner=run (typed), LockTable exclusivity, WellFormed invariant
  (a lock holder must be a non-terminal run — couples Lock and Run)
- System/Permission: read<edit<manage role lattice, capability derivation,
  can_mono monotonicity theorem; force-release sits outside the lattice (admin-only)
- System/Audit: intentionally thin (mostly plumbing, OPEN)

Courseware product layer — split the single Lesson file into focused modules and
fix doc tautology: Primitives / Element / Lesson / Render / Diagnostic, plus
QuestionBank and Course skeletons (core relations OPEN, not invented).
Diagnostic upgrades WarnsIgnored into a severity-tagged checker rule.

Element schema + rich-content model (ADR-0006, ADR-0007):
- docs/adr/0006: kind schema is declarative JSON Schema; field types are built-in
  scalars plus a `content` extension; a `content` value is typst source taken as
  module body; rich content must carry a VirtualPath (else click-to-jump and
  relative import break — verified against typst source); import boundary =
  within the engineering file + @package
- docs/adr/0007: on-disk form is a real directory tree (agent/grep friendly);
  VirtualPath = real relative path; layout conventions deferred
- spec/Courseware/RichContent: prose anchor for rich content (opaque VPath,
  RichContentRef); ElementData kept abstract — JSON/typst internals are
  implementation detail, not contract

lake build green (18 jobs), no sorry, toolchain v4.31.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

spec/Spec/System/Audit.lean

@@ -0,0 +1,27 @@
+import Spec.Prelude
+
+/-!
+# Audit —— 审计日志(有意从简)
+
+likec4 把 `AuditLog` 列为实体:`AgentRun -> AuditLog 'records lifecycle events'`,
+admin 经控制台审计。但**审计记录里装什么**(事件 schema、保留策略、可查询维度)
+在任何 ADR / 散文里都未决策,且大多是 plumbing——按分歧点测试**不入契约**:写明
+与否不会让开发者与 agent 各做不同假设。
+
+故本模块**刻意几乎为空**:只固定一条已决策的关系——审计以 run 为主体记录其生命
+周期事件——其余 `OPEN`。这里留白本身是契约的一部分(承诺"此处尚无答案,勿填")。
+-/
+
+namespace Spec.System
+
+/--
+审计条目的最小骨架(关系 `PINNED` / 内容 `OPEN`, likec4 `records lifecycle events`)。
+
+只承诺"一条审计记录关联到某个 run"。事件类型、时间、actor、详情等字段**未定**
+(`OPEN`),待出现真实分歧点(如"取消必须记录 actor")时再由对应 ADR 落定。
+-/
+structure AuditEntry (I : Identifiers) where
+  /-- 该审计条目所属的 run(`PINNED` 关系, likec4)。 -/
+  run : I.RunId
+
+end Spec.System