Add source manifest provenance schema

[nccrypto]

Summary

• add a versioned source-manifest JSON Schema for public-source provenance records
• add synthetic conforming source-manifest example and documentation
• extend schema contract tests and mark the roadmap item complete

Public sources / inputs

• Intentionally authored schema, docs, and synthetic example within this public repository
• No private profile, sibling repository, runtime state, credentials, wallet data, or unpublished research used

Security and privacy

• Keeps provenance records public-only and disallows unbounded extra fields
• Example contains no credentials, account data, local runtime state, or absolute private paths
• Boundary scanner passes locally

Verification

• PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src python3.11 -B -m unittest discover -s tests -q
• python3 scripts/check_public_boundary.py .
• git diff --check
• .venv/bin/python -m build --outdir /tmp/agentic-commerce-toolkit-dist-check

Rollback

• Revert commit 788c5da to remove the schema, docs, example, tests, and roadmap/changelog updates.