Add first-pass runtime-causality contracts v0

[mdheller]

This PR adds the first slice of runtime-causality contracts, including four schemas and four example files derived from ordered diagnostic logs. It collapses repeated failures, security verdicts, network truth ambiguity, and browser preflight transactions into typed, bounded records.

• Schemas: RetryLoopFingerprint, SecurityVerdictState, NetworkTruthState, BrowserLaunchTransaction
• Examples for each schema
• Documentation in docs/contract-additions/runtime-causality-contracts-v0.md

This prepares the SourceOS spec for reproducible diagnostics, browser/terminal child-process validation, and mesh/network intelligence evidence recording.

[mdheller]

Expanded runtime-causality scope

This PR has been extended beyond the original four-schema first-pass slice. Current branch scope now includes ten runtime-causality contract families:

1. RetryLoopFingerprint
2. SecurityVerdictState
3. NetworkTruthState
4. BrowserLaunchTransaction
5. RuntimeIdentityGraph
6. DesktopServiceBrokerState
7. MaintenanceEpoch
8. RuntimeRegistryIntegrityRecord
9. BootSessionPhaseState
10. DiagnosticStormRecord

Each schema has a corresponding example payload.

The documentation in docs/contract-additions/runtime-causality-contracts-v0.md has been expanded to describe the complete ten-contract surface, downstream consumers, and the intended runtime flow:

1. capture raw telemetry;
2. normalize repeated signatures into retry/storm records;
3. attach network, security, boot/session, and registry context;
4. gate browser/terminal launches through identity and broker preflight;
5. bound maintenance work with explicit epochs and emission budgets.

Remaining follow-up after this PR:

• add central schemas/README.md catalog rows;
• add validation automation for schema/example mapping;
• add a reusable ordered-log parser that emits these records;
• wire SourceOS shell, BearBrowser, TurtleTerm, MeshRush, and Prophet Platform consumers.

[mdheller]

Partial capture update.

Merged #108 / c4b87e9ff2f0c7b361b22d8628638dfe2e4d2957 as a current-main replay of the runtime diagnostic contract subset.

Captured in #108:

• schemas/RetryLoopFingerprint.json
• schemas/SecurityVerdictState.json
• schemas/NetworkTruthState.json
• schemas/BrowserLaunchTransaction.json
• schemas/DesktopServiceBrokerState.json
• schemas/MaintenanceEpoch.json
• schemas/RuntimeRegistryIntegrityRecord.json
• schemas/BootSessionPhaseState.json
• schemas/DiagnosticStormRecord.json
• matching synthetic examples
• tools/validate_runtime_causality_examples.py
• focused Runtime Diagnostics workflow

Validation observed on #108 head 2344c25a3261e84adc936c6217cb1327c2ba80f1:

• Runtime Diagnostics: success
• validate-ops-history: success

Remaining from this PR and intentionally not closed yet:

• schemas/RuntimeIdentityGraph.json
• examples/runtime_identity_graph.json
• full original contract-additions note if we want the non-synthetic source note recovered

Reason: the connector blocked the RuntimeIdentityGraph schema payload during replay. That file needs a safer replay path before this PR can be considered fully captured.

[mdheller]

Final capture update.

Runtime diagnostic contracts are now fully captured on current main across #108 and #110.

Merged #108 / c4b87e9ff2f0c7b361b22d8628638dfe2e4d2957:

• schemas/RetryLoopFingerprint.json
• schemas/SecurityVerdictState.json
• schemas/NetworkTruthState.json
• schemas/BrowserLaunchTransaction.json
• schemas/DesktopServiceBrokerState.json
• schemas/MaintenanceEpoch.json
• schemas/RuntimeRegistryIntegrityRecord.json
• schemas/BootSessionPhaseState.json
• schemas/DiagnosticStormRecord.json
• matching synthetic examples
• runtime diagnostic validator/workflow

Merged #110 / cec88e3795d164ed64a883f6d4c56f0de478d900:

• schemas/RuntimeIdentityGraph.json
• examples/runtime_identity_graph.json
• runtime diagnostic validator updated to include the identity-graph pair

Validation observed:

• Replay runtime diagnostic contracts on current main #108 head 2344c25a3261e84adc936c6217cb1327c2ba80f1: Runtime Diagnostics success; validate-ops-history success.
• Replay RuntimeIdentityGraph contract follow-up clean #110 head d918f86dd9312fe66cd66d4175bea23811da7f29: Runtime Diagnostics success; validate-ops-history success.

Content status: fully captured. This stale PR can be closed as superseded.