fix(cli,engine,core): Phase 0 correctness — honest refusals, verified identity, bounded serialization (#108)