feat: add inert capability pack contract

[MarcoPorcellato]

Summary

• add a strict, bounded TOML Capability Pack schema and parser for untrusted manifests
• validate provenance, pinned runtime policy, freshness metadata, duplicate-free normalized collections, and known shell-entrypoint boundaries
• expand one explicitly selected profile into the existing schema-1.3 execution plan without executing project code
• pin canonical pack, expansion, schema, and milestone manifests
• document the inert M2 contract, evidence boundaries, and M3 entry criteria

Compatibility boundary

This is an additive pre-1.0 Rust library contract. It does not change existing CLI syntax, receipt or policy schemas, configuration and matrix formats, execution behavior, or existing canonical plan bytes.

Verification

• cargo fmt --check
• strict workspace Clippy with warnings denied
• capability-pack contract: 27 passed
• compatibility manifest: 1 passed
• deterministic M2 manifest: 1 passed
• complete offline workspace suite: 494 passed, 5 ignored across 28 suites
• scoped compatibility diff over existing CLI/configuration/matrix/receipt/verification and schema surfaces: empty
• final specification review: approved
• final code-quality and security review: approved

Security and residual boundary

The implementation uses same-handle bounded regular-file loading, sealed validated identities, strict HTTPS authority validation, redacted debug output, and inert inspection/expansion. Special-file nonblocking policy remains a documented future design question; official pack execution, retrieval, installation, publication, and receipt integration remain outside M2.