feat: add point-in-time investment workflow domain contracts

[Altairpaca]

Sequencing status

Implementation is intentionally deferred behind the stable-release acceptance boundary now documented on main and reflected in roadmap #46. Keep this PR available as the deterministic foundation for the later research-workflow layer, but do not merge it merely to expand scope before the genuine release blockers (#6, #23, #34) are closed.

Goal

Move Clausula from reliable accounting/market primitives toward reproducible investment workflows without introducing opaque automated investment decisions.

Change

• add InvestmentWorkflow, WorkflowInputRef, WorkflowRun, and WorkflowArtifact domain contracts;
• enforce point-in-time semantics (effective_at <= known_at <= workflow as_of) to reject hindsight;
• require immutable SHA-256 provenance for workflow inputs and artifacts;
• enforce workflow run status/completion invariants;
• verify artifacts consume only digests already recorded by the run;
• export the contracts from clausula.domain;
• add deterministic tests for reproducibility, hindsight rejection, completion state and artifact provenance;
• document the intended investment workflow foundation.

Boundary

No model-generated trade decision or execution authority is introduced. These are deterministic workflow/provenance primitives for later research, thesis and decision workflows.

Merge gate

Re-review/rebase this branch after stable-release acceptance. At that point, verify that the workflow contracts reuse the final canonical research/artifact/accounting identities rather than creating a parallel truth system.

Refs #40 #46