Add RFC review metadata validation

[SoundBlaster]

Motivation

The RFC review dashboard is becoming a planning surface, but its source data has no versioned schema or enforceable metadata invariants. A malformed profile, stale RFC anchor, dependency cycle, or unsupported maturity claim can currently reach the generated dashboard.

Goals

• Establish a versioned metadata contract for profiles, releases, review dependencies, maturity, and evidence.
• Reject invalid or half-migrated planning data before the dashboard is generated.
• Keep the existing 60-card dashboard behavior unchanged until the follow-up migration PR.

Changes

• Add JSON Schema Draft 2020-12 for review-data.json, including an explicit transition mode and an all-or-none planning metadata bundle.
• Add profile and release registries at schema version 2.
• Validate registry references, profile/review DAGs, canonical RFC anchors, evidence identities, and maturity evidence rules.
• Add review-data-check, Python unit tests, and negative fixtures to the existing review build gate.

Validation

• make review-check PYTHON=/tmp/agent-surface-maintenance-uv/bin/python
• /tmp/agent-surface-maintenance-uv/bin/python -m json.tool review/review-data.schema.json
• /tmp/agent-surface-maintenance-uv/bin/python -m json.tool review/review-data.json
• node --check review/check_review.mjs
• git diff --check

Boundaries and Non-Goals

• Does not change RFC prose, review priorities, card coverage status, or dashboard UX.
• Planning fields remain transitional all-or-none optional fields in this PR; the stacked migration PR populates all 60 cards and makes them required.
• Maturity above specified and non-RFC evidence fail closed until authoritative evidence resolvers are added; arbitrary artifact paths cannot promote a card.
• blocks and readiness are derived state and are intentionally rejected if persisted.

Notes

• Stacked on PR Define the Action Execution Model #8 (codex/action-execution-model). The next PR migrates all 60 cards onto this contract.