feat: add versioned oven adoption and validated data flows

[apresmoi]

Summary

• Make Oven semantic versions first-class identities (id@version) and vendor per-project pins with explicit adopt and upgrade behavior.
• Move dashboard Oven routes to path-scoped repository identity and add contract-fit lens switching, an Oven catalog, and explainer/sample-data pages.
• Add burnlist oven use and burnlist oven set: use adopts a shipped package and binds only its exact example/data.json when present; set validates with the same built-in runtime authority before atomically replacing canonical git-ignored data and its binding.
• Extract shared validators for every built-in JSON Oven. Streaming Diff stays producer-managed, while custom Ovens without a runtime validator get explicit shape-only source-pointer validation.
• Document versioning, adoption, data shapes, starter availability, and the complete CLI flow in the skill and website.

Validation

• TZ=UTC npm run verify, npm run verify, npm run build:dashboard, and npm run verify:package pass on Node 18.20.8 and 20.19.6.
• npm run verify passes on Node 22.14.0 after the final commits.
• cd website && npm run build passes.
• The Oven data E2E test covers accepted data rendering, fresh and replacement rejection, exact rollback, custom shape-only validation, and example/no-example adoption.
• Root dependencies stays empty; every new file is <=400 lines.

Structure

• Read order: src/ovens/oven-registry.mjs (runtime authority) -> src/ovens/oven-data-validate.mjs (dispatch) -> src/server/oven-data-store.mjs (atomic publication) -> src/cli/oven-use.mjs + src/cli/oven-set.mjs (consumer flow) -> skills/burnlist/ + website/ (guidance).
• Canonical consumer data lives at .local/burnlist/data/<id>.json; validation succeeds before either data or binding is replaced.
• The branch keeps the versioning/catalog work and data-flow work in separate, Burnlist-tagged commits.

Notes

• A shipped JSON Schema remains informational reference documentation only. It is not the validation authority and does not enter the Oven revision or pin.
• Failed validation writes and binds nothing for a fresh install, and preserves the exact prior data and binding for an existing install.