feat: add observe-only control contract validator

[andrei-hasna]

Summary

• add a repository-internal, versioned hasna.control/v1 validator and deterministic lifecycle evaluator over existing generic metadata
• enforce canonical JSON/event hashes, closed shapes/enums, bounded token/array/TTL grammars, trusted-envelope claim matching, exact two-event freeze/unfreeze identity, replay/order handling, scope isolation, activation gating, and secret-shaped value rejection without value echo
• add portable conformance and legacy-blocker fixtures plus a linked contract and threat model
• remain strictly observe-only: every result has enforced: false; this PR adds no schema, ingress, API/store/CLI/MCP/SDK/hook integration, live controls, or enforcement

Security properties

• proxy-backed inputs are rejected before invoking traps; ordinary input is descriptor-snapshotted within pre-enumeration and pre-secret-scan bounds
• malformed or unsupported evidence/backends return indeterminate and never synthesize a global hold
• literal FREEZE, UNFREEZE, and BLOCKED content is inert; generic blocking=1 remains an ordinary blocker
• one control_id owns one lifecycle within tenant + authority domain; reuse is rejected and makes evaluation indeterminate rather than definitive allow
• future observations are decision-neutral for historical evaluation; stale, late, reordered, mismatched, or expired releases cannot clear a freeze

Fixtures

• fixture id: project-freeze-unfreeze
• freeze event id: sha256:41a6e7b5480d20fd587b3170ee6615bd509e6fc4411f5ce15f612b0bc4328547
• unfreeze event id: sha256:0b5500cd5f2c29b65badf330b612100baa44052cf8c607fb39ee6414c19eb6f3
• canonical sequence hash: sha256:0cffbec5ba8980dd9b2fd27e0c52b472f285dd7da8efc910a28351141c1d0b31
• conformance file SHA-256: efbb35f3d438c50f26bc6110dc4f7c4e72016e0f57e65ca43174984232731f79
• legacy fixture id: legacy-blocker-text-is-inert
• legacy file SHA-256: 56a7397337cfd6f9b2982823f7d505baee8b4771f4abeb3a2fb0b3ee2ee8d0c6

Verification

• bun test src/lib/control-contract.test.ts src/lib/control-evaluator.test.ts src/lib/control-conformance.test.ts — 37 pass, 0 fail
• bun run typecheck — pass
• bun run build — pass
• full bun test — 1046 pass, 2 unrelated failures in unchanged base surfaces:
  • src/contract.test.ts: installed @hasna/contracts@0.5.2 now requires serviceSurfaces; this range does not change the manifest, dependency files, or test
  • src/lib/storage-sync.test.ts: station-local storage config returns a local Postgres URL; the isolated test passes with HASNA_CONVERSATIONS_STORAGE_MODE=local
• two fresh independent exact-head adversarial reviews at 70047e5c11c7f2d96aaf5499e75700fc5b920763 — PASS, 0 P0/P1/P2/P3 in both lanes
• staged and full-range redacted gitleaks scans — no leaks
• git diff --check, prohibited-path audit, and Co-Authored-By audit — clean

Required integration follow-ups

1. Trusted Conversations ingress must derive authenticated principal, tenant, authority domain, permitted surface, policy version, immutable server ingress time, and blocking state from server-owned context/columns; caller metadata must not supply these claims.
2. A bounded observation adapter must read existing metadata, return exact available/unavailable snapshots, preserve activation eligibility, and enforce the row cap without adding schema.
3. Codewith PreToolUse must map exact operation/resource/tenant/domain/scope and emit redacted telemetry only while observe-only; enforcement requires a separate reviewed activation.
4. Add the package export only after the overlapping src/index.ts lane/PR feat(storage): replicate messages + read receipts across the fleet (uuid-keyed incremental sync, interim shared storage) #11 lands.

No merge, publish, install, deploy, rollout, or live-control activation is included.