Specify family connection and context configuration v1

[fruwe]

Summary

• Add the public, language-neutral family connection/context configuration v1 contract.
• Define a closed logical data model with exact types, required fields, duplicate handling, unknown-field rejection, and normative validation vectors.
• Define collision-free environment override encoding for arbitrary valid product/resource segments and the required routing precedence.
• Pin deterministic endpoint canonicalization to RFC 3986, RFC 4291, RFC 5952, UTS #46 revision 31, and Unicode 15.1.0, with canonical and rejected vectors.
• Require credential providers and locator names to contain references only, never secret material.
• Reserve config, context, and auth for future family commands without changing current launcher behavior.
• Keep local implementation selection, State storage URIs, embedded execution, and future remote clients at distinct boundaries.

Review corrections

• Distinguish state/foo-bar, state/foo/bar, and repeated-hyphen segments in environment variable names.
• Specify root paths, IDNA, ports, percent encoding, IPv4, IPv6, zones, dot segments, and unsupported endpoint forms without runtime-library defaults.
• Close every configuration object and define empty-map, reference, and logical-name behavior for future conformance vectors.
• Change the credential invariant to MUST NOT contain secret material.

Explicitly excluded

No networking, credential storage, client or protocol implementation, launcher behavior change, State change, route-binding schema, version change, release, or merge.

Validation

• Documentation local-link check
• Environment-name vector check
• IDNA and IP canonical vector checks
• git diff --check
• Python: ruff check .; pytest -q (12 passed)
• Rust: release build; release clippy with warnings denied; tests (8 passed)
• Node: node test/dispatch.test.js

Closes #8