feat: expose optional PliegoCSS product topology

[terrizoaguimor]

Problem

PliegoCSS needs a stable, runtime-free view of PliegoRS routes, components, islands, and source ownership. The published PliegoRS release does not expose that build seam, and development reloads could be starved by access-only filesystem events or emit duplicate no-op generations.

Change

• Add the versioned pliegors-product-topology/1 JSON snapshot and canonical JSON Schema.
• Validate portable source units and emit deterministic registry order.
• Document the optional build-only integration boundary without linking PliegoCSS crates.
• Filter access-only development watcher events, preserve real changes under event pressure, and suppress no-op reload generations.
• Refresh the h2 security release and Hyphae fixture identity.

Public API: adds ProductRegistry::to_topology_json and PRODUCT_TOPOLOGY_SCHEMA. The seam is additive and optional; runtime behavior remains independent of PliegoCSS.

Verification

• Focused tests cover topology serialization, path validation, watcher starvation, failure recovery, and no-op publication.
• cargo fmt --check passes.
• Hosted CI passes on abb8653e75da4a5cb4dd9b51200114fbb1e760c7: https://github.com/celiumsai/pliegors/actions/runs/33118304732
• CodeQL passes on the exact head: https://github.com/celiumsai/pliegors/actions/runs/33122373615
• Applicable workspace, documentation, package, browser, provider, and site checks pass.
• Dependency audit includes h2 0.4.16; no redistributed assets were added.
• Documentation and diagnostics match the implemented behavior.

No tag, release, or crate publication is part of this PR.