Require explicit RuleSpec roots in the Axiom adapter

[MaxGhenis]

Summary

• Require every AxiomEngine caller to provide a non-empty explicit sequence of canonical RuleSpec roots.
• Forward that exact authority boundary, together with the requested entity, to the current Axiom dense loader.
• Propagate root and module validation failures; only the engine's exact no-derived-output condition remains an optional missing entity.
• Move the test module into a canonical rulespec-zz layout and update all in-repo callers, docs, and changelog.

Why

The current Axiom runtime requires CompiledDenseProgram.from_file(..., rulespec_roots=..., entity=...). Microcosm still called the retired implicit-root signature, so the Belgian pilot in PolicyEngine/policyengine.py#448 could not execute against the current runtime. Explicit roots also make the filesystem authority boundary reproducible and fail closed.

This intentionally changes the adapter constructor. External callers must pass their canonical checkout, for example rulespec_roots=(rulespec_be_root,).

Verification

• Authoritative Axiom main bb4b5684: 49 passed, 12 skipped
• Full microcosm-frame suite: 275 passed, 25 skipped
• Full Ruff check: passed
• Changed-file format check: passed
• CI test-group verification: passed
• Lock check and git diff --check: passed
• Independent review: clean

Residual risk is fail-safe: missing-entity discrimination currently follows Axiom's exact error text, so upstream wording drift would raise rather than silently broaden authority.