feat(api): let one suspect answer a question

[Madeuss]

First half of E2 (#6). A suspect answers, and every consequence of the answer is
decided by code.

The order is the design

dossier → prompt → model → schema → scope → canary → stance → statement

Everything before the model is projection. Everything after is verification. The
model produces one thing — a line of dialogue — and nothing it says decides
anything (RN-022, RN-023, RN-042).

All of it runs with no API key:

$ FIRENZE_MODEL_PROVIDER=fake make ask SEED=42 WHO=sus-1 Q="onde você estava às 22h?"
Vitória Belmiro (cooperative)
  [fake] line c0efbd09

  mentiu: False
  fato citado: —
  turnos restantes: 29

Synthetic words, real pipeline.

The hole this found

The rules anticipated it; the code did not. The culprit did not know they were
the culprit.

They were alone with the victim, so no presence fact was ever written about them
at that hour — no witness, no fact. Nothing in their own dossier incriminates
them. A culprit would have answered with the same easy conscience as an innocent
who happens to lack an alibi, and the mystery would have had no centre.

RN-011 already covered it: the Solution entity stays out of a suspect's
context, but "o culpado sabe apenas da própria culpa". So Dossier became the
boundary — the one place that reads the solution, emitting one bit about
oneself and nothing else. Not the means, the motive, the chain, or who else
might have done it. Tests assert exactly that.

Worth naming why it stayed hidden: an invariant that nothing exercises is an
invariant nobody has checked. It surfaced the moment an NPC actually had to
answer.

The stance machine

The model suggests; the machine decides (RN-023). An illegal move is overruled
silently for the player and reported for the evals.

broken is unreachable from any suggestion. A suspect breaks when confronted
with evidence that invalidates what they said — a computed game event (phase 4),
not a mood a model adopts because the question felt intense.

A rejected reply still costs the turn

Deliberate. A budget that only charged for answers the system liked would be a
budget a player could farm by provoking failures.

Also here

The fake now omits optional fields instead of inventing them. It was filling
fact_referenced with a synthetic id, which the scope guard correctly rejected —
an invented id is precisely what that guard exists to catch, so the fake should
not manufacture one.

prompts_dir moved to a shared module: interrogation was importing it from
veneer, coupling two packages to find a directory.

113 passed · ruff clean · mypy strict: 27 files, no issues

Not here yet

Persistence (the match lives in memory), the HTTP endpoint, streaming, and
memory retrieval with pgvector. And the words: the provider is in pilot.