refactor: remove controller surface and fix persistence

[rlippmann]

What changed

• Removed the public controller and audit APIs, including preview, structural diff, and controller result-envelope helpers.
• Simplified the REPL by removing the preview command and routing committed input directly through Engine.step(...).
• Removed the associated public exports, fixtures, examples, documentation, and tests tied only to that retired surface.
• Removed the controller-specific CI coverage gate now that context_compiler.controller no longer exists.
• Fixed an import/export persistence invariant so exported authoritative state always remains re-importable under the runtime's current policy-key validation rules.

Why

• The public controller/audit surface was introduced for the earlier auditability, checkpoint, continuation, and confirmation-oriented architecture, but those surrounding capabilities have since been removed or extracted.
• Removing that now-unused public surface keeps the authority layer focused on deterministic engine-owned state transitions and the remaining public runtime APIs.
• The CI update keeps coverage enforcement aligned with the supported modules instead of a deleted controller module.
• The persistence fix closes a real contract bug in the export/import boundary by preventing import_json(...) from accepting policy keys that normalize into non-stable authoritative keys.

Checklist

• pre-commit run (uv run pre-commit run --all-files)
• tests pass (uv run pytest)