door ingest: anchor card matching to the HeatSync hex-uid model

The inbound-ingest matcher read a stored card_uid as both decimal and hex,
which mis-attributed all-digit uids (a stored "16" is hex 0x16 = 22, but it
wrongly matched a decimal poll of card 16) and was conceptually wrong.
HeatSync stores the uid as hex (the grant encoder requires it) and the ?z
log / webhooks report the decimal card number, so cardMatchesEvent now
matches a reported decimal when hexInt(storedUid) equals it, and matches a
webhook card_uid by exact string. This removes the false positive while
keeping every legit match. Attribution is audit-only (never an access
decision) and inert until a space enables ingest; no migration.

Also records the pass-63/64 door-epic deploy state and the pass-65 audit in
the handoff log.

lib/door/ingest.ts

@@ -11,8 +11,7 @@ import { resolveDoorSecret } from './secret'
 import { encodeHeatSyncControl, applyTemplate, redactDoorSecrets } from '@/lib/door-logic'
 import {
   parseHeatSyncLog,
-  cardUidsEquivalent,
-  eventCardValue,
+  cardMatchesEvent,
   type DoorIngestEvent,
 } from '@/lib/door-log-logic'
 
@@ -78,8 +77,7 @@ export async function ingestEvents(
       skipped++
       continue
     }
-    const value = eventCardValue(ev)
-    const card = value ? cardList.find(c => cardUidsEquivalent(c.card_uid, value)) : undefined
+    const card = cardList.find(c => cardMatchesEvent(c.card_uid, ev))
     const targetMemberId = card?.member_id ?? null
     if (card) resolved++