feat: capability authority plane, exactness/stale-state contracts, Systema mappings, State Integrity program

[mdheller]

Closes #92, #97, #83, #103

What's in this PR

New schemas (5):

• CapabilityContract — pre-runtime capability declaration for any SourceOS component
• CapabilityGrantState — observed runtime grant state per capability, links to policy and repair
• ExactnessArtifactRecord — exactness-sensitive artifact metadata (IDs, checksums, versions, config fields) with verifier receipt requirement
• StaleStateRecord — stale-state and validity-interval metadata, distinguishes observed/event/valid time, links to repair plan
• LocalReasoningFailure — local-first reasoning failure record with context hydration boundary, suppressMutation flag, repair plan linkage

New examples (5): one per schema, covering BearBrowser TCC denials, checksum mismatch, package version exactness, and model string-exactness violation.

Systema contract-additions docs (4):

• systema-source-confidence.md — maps to ProvenanceRecord, ValidatorReceipt, ReasoningAssay, StaleStateRecord
• systema-projection-loss.md — maps to ReasoningAssay, LocalReasoningFailure, ExactnessArtifactRecord
• systema-membrane-boundary.md — maps to CapabilityContract, CapabilityGrantState, ExecutionDecision, AgentCapabilityLease
• systema-capability-radius.md — maps to AgentCapabilityLease, CapabilityPolicy, LocalReasoningFailure

State Integrity implementation program (docs/sourceos-state-integrity-program.md):

• Locks sourceos-syncd as the implementation home
• Defines the ten questions every object must answer
• Locks MVP object model, CLI surface, adapters, policy hook, conflict type, repair path, observability
• Maps lane ownership across all integration repos