Add infra service deployment contract fields

[andrei-hasna]

Summary

• extend hasna.service_contract.v1 with deploymentModes and serviceSurfaces for supported/deferred/unsupported infra HTTP/MCP service boundaries
• add readiness gate fields for auth, storage, secret-ref, migration, health, readiness, redaction, smoke, and operator evidence
• add an infra service entrypoint matrix covering open-backup, open-bridge, open-domains, open-hooks, open-machines, open-releases, open-secrets, open-servers, open-uptime, open-gateway, and open-monitor

Validation

• bun run typecheck
• bun test
• bun run conformance
• bun run build
• git diff --check
• staged secret-pattern scan over cached diff: no findings

Coordination

Worker 3 also has an open-contracts provider-standard branch. This PR is scoped to infra service/deployment contract fields and the infra matrix only. Landing order: either merge this before provider-standard, or rebase it over provider-standard if Worker 3 lands first. Do not overwrite provider/live-mode changes.

No Co-Authored-By trailers.