office: attach runtime contract records to guarded evidence

[mdheller]

Summary

Adds the SourceOS-side bridge from guarded local Office Plane evidence to the open office runtime contracts now landed in SocioProphet/prophet-platform.

This keeps sourceosctl office behavior stable while adding a new officeRuntimeContracts block to materialized guarded evidence. Dry-run plans and failed/no-hash operations do not emit committed runtime records.

Changes

• Adds sourceosctl/commands/office_runtime_contracts.py to build:
  • officeDocumentRecord
  • officeSessionRecord
  • officeVersionRecord
  • officeWritebackRecord
• Wires guarded Office evidence to include officeRuntimeContracts only when a materialized artifact hash exists.
• Extends office evidence inspect to summarize runtime contract ids when present.
• Changes the unused remote-api default backend map from microsoft-graph to sourceos-remote so SourceOS local CLI defaults do not imply closed-provider runtime authority.
• Adds focused integration documentation under docs/integration/office-runtime-contract-evidence.md.
• Adds unit tests covering runtime contract emission, no-hash behavior, evidence inspection, and the closed-provider boundary.

Validation target

make test
make validate

Boundary

No Google Workspace, Microsoft 365, Microsoft Graph, Apple iCloud, or Apple Notes runtime dependency is introduced. Closed-provider support remains migration/import/export territory, not local SourceOS Office execution authority.