Foundation contracts for portable jarvOS product realization

[levineam]

Summary

Adds the repository-only foundation for jarvOS to autonomously prepare source-backed candidates from eligible AI interactions while keeping durable promotion governed and reversible where the destination supports it.

• adds portable opaque identity validation
• adds a capability truth ledger with independent specification, implementation, repository, verification, activation, and authority dimensions
• adds immutable non-authoritative candidate envelopes
• adds cross-surface promotion receipts that distinguish committed state from failed, deferred, conflicted, and already-satisfied attempts
• adds a shared data-driven conformance fixture matrix
• reconciles the product and secondbrain architecture documentation with the digital-twin / one-mind-many-harnesses direction

Safety boundary

This PR contains contracts, fixtures, tests, and documentation only. It does not install or activate jarvOS, write to a Vault, change a scheduler or runtime, issue live identities, create candidate storage, execute destination writes, or alter any private host.

The implementation deliberately avoids files currently changed by PRs #249, #252, #253, #255, and #256.

Verification

• full npm test: pass
• control-plane suite: 139 tests pass
• candidate contract suite: 12 tests pass
• foundation conformance matrix: 27 checks pass
• structure smoke test: 66/66 pass
• git diff --check: pass

Fable 5/high drafted the initial plan and Codex integrated safety corrections. Long Opus implementation generations stalled, so the authorized OpenAI fallback completed those stages. A bounded Opus/high review of the critical validators found no blocking defects; its timestamp-hardening feedback was integrated in commit 8d41a2d.

Known pre-existing issue

The package-local jarvos-ambient suite has one stale expected error string in intent-exports.test.js: it omits Hermes and Grok Bot even though both source tools were already present at the exact base. This PR does not change that pre-existing test or source-tool list. The new candidate tests and the full root suite pass.

Mac Mini handoff

Review this contract layer before implementing consumers. Live identity issuance, source adapters, candidate persistence, destination-specific writers/receipts, activation, and OpenClaw integration remain intentionally deferred until the existing installation and its authority boundaries can be inspected.