ichor(D2): start the Pony wiring — broker + D1 barrier + envelope

Name the medium Ichor and scaffold it in Pony at src/ichor:
- Envelope {source,dest,provenance,payload} mirroring Ada Organ_Message
- Broker actor: register + perfusion route; Brain-bound traffic crosses D1
- Barrier (D1) admit: Pony provenance-law mirror + Ada FFI seam sketched
- StubOrgan + main smoke wiring (deliver internal, reject external)
- ichor_ada_shim.c: C/Fortran binding seam to Ada Trust_Guard (stub)
Not compiled in-env (no ponyc). Updates D2 spec to SCAFFOLD/Pony.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015hmgREHNsxYCuim33yUF2c

src/ichor/barrier.pony

@@ -0,0 +1,39 @@
+"""
+The blood-brain barrier (D1). `Barrier.admit` is the screening decision every
+Brain-bound envelope must pass — perfusion law L2: everything reaching the Brain
+crosses Ada (D1) first.
+
+Real wiring crosses into Ada's `Trust_Guard` (provenance + blocklist + rate) via
+the C/Fortran seam (`ichor_ada_shim.c`). Until that binding is built, this mirrors
+the provenance law in pure Pony so the broker is testable standalone.
+
+To switch to the Ada border, add `use "lib:ichor_ada"` and replace the body of
+`admit` with the FFI call sketched below.
+"""
+
+primitive Barrier
+  fun admit(envl: Envelope): Bool =>
+    // Pony-side mirror of D1's provenance law (stand-in for Trust_Guard).
+    match envl.provenance
+    | SystemInternal => true
+    | External => false  // external never free-passes the barrier; D1 must screen
+    else
+      true
+    end
+
+  // --- Ada seam (enable once the C shim + ponyc are present) -----------------
+  // use "lib:ichor_ada"
+  //
+  // fun admit_via_ada(envl: Envelope): Bool =>
+  //   @ichor_ada_admit[Bool](
+  //     _provenance_code(envl.provenance),
+  //     envl.payload.cpointer(),
+  //     envl.payload.size())
+  //
+  // fun _provenance_code(p: Provenance): U8 =>
+  //   match p
+  //   | SystemInternal => 0
+  //   | UserInput => 1
+  //   | OrganSecretion => 2
+  //   | External => 3
+  //   end