feat(contracts): contrato de aplicación y cláusulas verificables

[Alexendros]

Summary

• ADR-0011 (proposed): la selección del configurador genera un contrato que el programa cumple y verifica, sin ampliar DEC-001.
• Schemas application-contract + siete cláusulas con corpus válido/inválido; formulario kind:clause e issues [Clause] CLAUSE-BASE-001 #81–[Clause] CLAUSE-BOOT-001 #87.
• Tests estrictos (agente test-writer) + verificador Rust en archmaker-core::contract (8/8 verde).

Cláusulas

Id	Issue	Schema	Test
CLAUSE-BASE-001	#81	clause-base	clause_base_001_accepts_valid_and_rejects_invalid
CLAUSE-MANIFEST-001	#82	clause-manifest	clause_manifest_001_digest_stable_across_formats
CLAUSE-OPTION-001	#83	clause-option	clause_option_001_rejects_cmd_pacstrap_and_embedded_binaries
CLAUSE-RULE-001	#84	clause-rule	clause_rule_001_rejects_presets_and_silent_mutation
CLAUSE-BYTES-001	#85	clause-bytes	clause_bytes_001_idempotent_export_same_selection
CLAUSE-HOST-001	#86	clause-host	clause_host_001_no_spawn_no_root_no_network_for_manifest
CLAUSE-BOOT-001	#87	clause-boot	clause_boot_001_rejects_satisfied_until_image_admitted

Test plan

• python3 tools/validate_front_matter.py
• Corpus JSON Schema de contratos/cláusulas (24–31)
• cargo test -p archmaker-core --test application_contract --locked (8 passed)
• CI verde en este PR

---

Note

Medium Risk
New normative contracts and Rust verification encode export, branding, determinism, and host-behavior rules that will gate future artifact flows; scope is mostly additive but mistakes could block valid exports or accept invalid contracts.

Overview
Introduces ADR-0011: a typed application contract from resolved configurator output (Arch Linux x86_64 base + DEC-001 export formats only—no image target).

Adds application-contract.schema.json and seven clause schemas (CLAUSE-*-001) with valid/invalid corpus fixtures (24–31), CHANGELOG v0.2, and json-schema CI registration for meta/corpus validation. A kind:clause GitHub issue template standardizes tracking (schema path, test name, compliance state).

Ships archmaker_core::contract with verify_clause / verify_application_contract (semantic checks per clause + contract shape; boot clause cannot be satisfied yet) and an 8-test integration suite against the JSON examples. Public API re-exports the verifier from lib.rs; wiring into export/CorePort is not part of this diff.

^{Reviewed by Cursor Bugbot for commit 2db029a. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 438f094e-fb91-477c-b2a3-3f0c69a20f5b)