Promote Holmes to M3 with schemas and negative fixtures

[mdheller]

Summary

Promotes Holmes from M2 to an M3 evidence set by adding explicit contract schemas and negative-fixture enforcement.

This PR adds:

• schemas/holmes-surface.schema.json
• schemas/holmes-proof-claim-contract.schema.json
• four negative fixtures under fixtures/invalid/
• tools/run_negative_fixtures.py
• reusable validation functions in tools/validate_holmes.py
• validate-contracts and validate-negative-fixtures Makefile targets
• repo.maturity.yaml updated to M3 -> M4 with evidence naming schemas, fixtures, runner, CI, and validation gates

Why

Per the estate maturity model, M3 requires CI validation plus negative fixtures and a negative-fixture runner. Holmes already had CI and positive validation; this PR completes the rejection side of the contract.

Validation

Expected:

make validate

Expected output includes:

OK: Holmes maturity manifest validated
OK: Holmes contracts validated
OK: Holmes negative fixtures rejected

Remaining M4 work

• release notes
• checksums
• SBOM/provenance attestation
• signed release path
• workspace-inventory/Sociosphere registration confirmation