ichor(D2): start the Pony wiring — broker + D1 barrier + envelope

Name the medium Ichor and scaffold it in Pony at src/ichor:
- Envelope {source,dest,provenance,payload} mirroring Ada Organ_Message
- Broker actor: register + perfusion route; Brain-bound traffic crosses D1
- Barrier (D1) admit: Pony provenance-law mirror + Ada FFI seam sketched
- StubOrgan + main smoke wiring (deliver internal, reject external)
- ichor_ada_shim.c: C/Fortran binding seam to Ada Trust_Guard (stub)
Not compiled in-env (no ponyc). Updates D2 spec to SCAFFOLD/Pony.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015hmgREHNsxYCuim33yUF2c

src/ichor/main.pony

@@ -0,0 +1,29 @@
+"""
+Ichor smoke wiring (D2 §9 test): round-trip an envelope between two stub organs
+through the D1 admit check, and confirm an unscreened external payload is rejected
+at the barrier.
+
+Build (where ponyc exists):   ponyc src/ichor -o build
+Run:                          ./build/ichor
+"""
+
+actor Main
+  new create(env: Env) =>
+    let broker = Broker(env.out)
+
+    let soul = StubOrgan(Soul, env.out)
+    let brain = StubOrgan(Brain, env.out)
+    broker.register(Soul, soul)
+    broker.register(Brain, brain)
+
+    // A system-internal secretion soul -> brain: must cross D1 and be delivered.
+    broker.route(Envelope(Soul, Brain, SystemInternal,
+      "big4 drawn: sun/asc/moon/mother-other"))
+
+    // An external payload aimed at the brain: D1 must reject it.
+    broker.route(Envelope(AdaBorder, Brain, External,
+      "unscreened external payload"))
+
+    // Organ-to-organ perfusion (not Brain-bound): delivered directly.
+    broker.route(Envelope(Brain, Soul, OrganSecretion,
+      "reshuffle: cross-only"))