Add optional proofs for an exact human structure decision

Why: A model-visible flag cannot prove that a person confirmed one proposal revision and payload hash.
Evidence: go test ./pkg/extension ./internal/app ./internal/server -run 'HumanDecision|SurfaceSnapshot|ResolveHuman|NaturalLanguage' passed locally.
Impact: SurfaceVersion 2.22.0-experimental adds HumanDecisionVerifier. Existing Host methods stay unchanged, and the base does not consume the proof.
Refs: W4b human confirmation design r1
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/cmdbus/cmdbus.go

@@ -101,6 +101,18 @@ type Request struct {
 	AnchorMessageID string // 确认卡锚定的发起消息（内联渲染）
 	Confirmed       bool   // 危险命令经确认卡放行后的执行
 	HostProjectID   string // EXT-18：分发所属基座项目（空＝无项目上下文）
+	// HumanGrant is set only by the authenticated session path or the human
+	// decision resolver. Client JSON and agent tool dispatch leave it nil.
+	HumanGrant *HumanGrant
+}
+
+// HumanGrant ties this dispatch to one persisted human response.
+// It is not a secret token and is not read from command params.
+type HumanGrant struct {
+	CardID   string
+	ProofID  string
+	Actor    string
+	Decision string
 }
 
 // Response 分发结果：回执 + 处理负载 + 可能的确认卡。