feat: add semantic context receipts

[ezutfen]

Summary

• Add the independent semantic-context-manifest-v1 contract and a default-off, fail-open authoritative semantic receipt path.
• Use the serving token-budget contract in semantic packing and receipt validation.
• Close all nested semantic wire structures, freeze canonical vocabularies, and fail closed for unknown receipt contracts or impossible profile combinations.
• Add exact Python and independent JavaScript conformance coverage with 10 positive vectors and 48 negative fixtures.
• Add semantic dark-write, integration, RLS, inspection, verification, shadow no-write, response-parity, migration, and deployment coverage.
• Preserve startup Context Manifest behavior and the frozen startup conformance vectors.

Closes #194.

Validation

• make check — lint and all five strict-mypy gates passed; host test phase could not reach localhost:5432 (2425 passed, 1590 skipped; DB-dependent only)
• make compose-ci — 4015 passed, 37 skipped; SDK 57, hooks 190, MCP 37
• Semantic Python vectors — 10 verified
• Semantic JavaScript vectors — 10 verified
• Semantic Python negative fixtures — 48 rejected
• Semantic JavaScript negative fixtures — 48 rejected
• Startup Python/JavaScript conformance — 10 positives and 20 negatives verified
• Exact-head hosted CI run 34233737736 — all green
• Credential leak scan — passed

Serving policy

• CERTIFIED_SERVING_PROFILES remains {legacy}.
• Ordinary semantic serving remains legacy.
• Governed and exploratory profiles remain shadow-only.
• Shadow comparison does not persist candidate receipts, logs, exposure, review, assessment, evidence, feedback, or promotion state.
• No ENG-EVIDENCE-001 — Evidence-root-aware corroboration and usefulness lane #161 usefulness or corroboration behavior is included.

Final contract correction

• Semantic vectors 001–006 and 010 remain byte/hash-identical.
• Authorized vectors 007–009 were corrected to canonical risk_aware_shadow_v1, direct_statement, and would_admit; only their canonical JSON and manifest hashes changed.
• Packet hashes, query/request digests, and served-content hashes for 007–009 remain unchanged.