Trích kernel domain-agnostic từ reins thành axiom-kernel; đóng gói tái bảo hiểm
thành pack đầu tiên. Gate hồi quy XANH: 10/10 module, 718 phép kiểm (608 ca contract).

- kernel/ (axiom-kernel): pipeline/expr/rules/workflow/validation/security/db + spi/
  (EngineSPI/EntitySPI/ScopeSPI + 4 builtin generic). Bóc 4 điểm rò rỉ domain:
  PK_MAP->EntitySPI, abac_scope generic, ENGINES dict->EngineSPI, WORKFLOW_ENTITY->wf.entity.
  Bất biến 1 chiều pack->spi->kernel (axiom lint-deps sạch).
- packs/reinsurance/: 286 JSON config + 12 engine domain + entities(PK_MAP) + pack.cue/json
  + auto-register SPI + 10 test module + test_suite.json. Vá 2 test-data đỏ-sẵn (business_unit).
- packages/pack-registry: discover->resolve->build_bundle + run_tests gate runner.
- packages/metadata-dsl: CUE dsl.cue (5 schema + #Pack) + codegen TS/Python (degrade nếu thiếu cue).
- apps/gateway: FastAPI nạp bundle, /gw/* -> Pipeline (AXIOM_DB=memory|postgres).
- tooling/cli: axiom build|test|vet|new|lint-deps.
- docs/adr: 10 ADR; .github/workflows/ci.yml; uv workspace + turbo/pnpm.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>