Add datalog-based invariant verification system

Implement a new datalog verification layer using datafrog that:

- Compiles rulespec to datalog on plan_approve
- Extracts facts from action envelope using selectors
- Executes datalog rules on plan_verify
- Writes evaluation results to datalog_evaluation.txt (shadow mode)

Key components:
- crates/g3-core/src/tools/datalog.rs: Full datalog module with:
  - compile_rulespec(): Validates and compiles rulespec
  - extract_facts(): Extracts facts from envelope YAML
  - execute_rules(): Runs datafrog iteration
  - 23 comprehensive tests

- crates/g3-core/src/tools/plan.rs:
  - execute_plan_approve(): Now compiles rulespec on approval
  - shadow_datalog_verify(): Runs datalog and writes to eval file

Results are written to .g3/sessions/<id>/datalog_evaluation.txt
for inspection, NOT injected into context window (shadow mode).

crates/g3-core/Cargo.toml

@@ -47,6 +47,9 @@ tree-sitter-racket = "0.24"
 streaming-iterator = "0.1"
 walkdir = "2.4"
 
+# Datalog engine for invariant verification
+datafrog = "2.0.1"
+
 base64 = "0.22.1"
 
 [dev-dependencies]