Report auth_immutable: whether an issuer's flags can still change

> **This issue is the reference standard.** Every other check issue links back here for the expected level of detail. If something below is unclear, that is a defect in this issue — say so and it gets fixed. ## What Report whether an issuer has set `auth_immutable` on its account, and what that means for the other flags. `issuer.auth-flags` (already implemented) reports whether an issuer *can* freeze or claw back an asset. It does not report whether those powers can still be **turned on later**. `auth_immutable` is the flag that answers it: once set, the issuer's other auth flags can never change. ## Why it matters The existing check describes the present. A passing result means "the issuer cannot freeze this asset **right now**" — and flags can be set at any time afterwards, so today's clean result says nothing about tomorrow. `auth_immutable` converts that into a permanent guarantee. An issuer with clean flags *and* `auth_immutable` has given up the ability to freeze or claw back, irreversibly. An issuer with clean flags and no `auth_immutable` has merely chosen not to, so far. Those are very different assurances, and a reader deciding whether to hold an asset deserves to know which one they have. ## Which layer **Layer 1 — observable fact.** It is read directly from the ledger. Nothing is inferred, and the result may not be more certain than that one Horizon read. ## Exactly where the code goes - **New file:** `checks/issuer_flag_immutability.go` - **Tests:** `checks/checks_test.go` (append; the file is already the home for every check's tests) - Must implement the `Check` interface in `checks/checks.go` — `Describe() Descriptor` and `Run(ctx, Subject) CheckResult` - Register it in `Runner.Default()` in `checks/runner.go` **Read `checks/issuer_auth_flags.go` first.** It reads the same Horizon resource and is the closest existing example; this check is deliberately a sibling of it. ## Where the data comes from Horizon's account resource: ``` GET https://horizon.stellar.org/accounts/{issuer} ``` The field is `flags.auth_immutable` — a boolean, alongside `auth_required`, `auth_revocable` and `auth_clawback_enabled`. Docs: https://developers.stellar.org/docs/data/apis/horizon/api-reference/resources/accounts Contract: [docs/checks.md](https://github.com/Wayfare-labs/wayfare/blob/main/docs/checks.md) ## What "unmeasurable" means here Three distinct cases. **None of them is `false`.** | Situation | Result | |:---|:---| | Horizon unreachable, or non-200 | **UNABLE-TO-DETERMINE**, reason naming the failure. Our data source failed; that says nothing about the issuer | | Subject names no issuer (native XLM, fiat) | **UNABLE-TO-DETERMINE** — there is no account to read | | Account returns 404 | **Determined failure** — the ledger was asked and answered that no such account exists | The distinction in the first row is the one to get right: a network failure must never be reported as a finding against the issuer. `checks/issuer_auth_flags.go` shows both branches. ## Acceptance criteria - [ ] Implements the Check contract in `docs/checks.md` — does not invent a parallel shape - [ ] Returns UNABLE-TO-DETERMINE (not zero, not a default, not `false`) when the data is unavailable - [ ] Records evidence: names what was observed and where, so a reader can verify it independently - [ ] Network I/O goes through the `http.RoundTripper` seam so the check is replayable from snapshots - [ ] Table tests driven from recorded bytes — no live network in tests, verified with `make offline-test` - [ ] Includes a negative test: a case where the check must fail or return undeterminable, not only the happy path - [ ] `decimal.Decimal` for any money or rate; no `float64` (n/a here — no money involved) - [ ] No new third-party dependencies - [ ] `gofmt`, `go vet`, `go test -race`, `golangci-lint` all clean - [ ] Does not change the headline integrity state or verdict thresholds Specific to this check: - [ ] `Descriptor.CannotDetermine