feat(vedic): add P1 contracts and provider skeleton

[Jowitt13]

Summary

Reserve the fourth first-class system id (vedic) across all engine contracts and wire a
provider skeleton that computes nothing: explicit systems: ['vedic'] requests always
return null plus a single structured SYSTEM_NOT_YET_IMPLEMENTED warning — no graha
positions, no Lagna, no panchanga, no dasha dates, no fabricated provider/ruleset provenance.

What stays unchanged

• Default systems array: ['western', 'bazi', 'ziwei'] (vedic is opt-in only).
• PublicResult / AnswerPlan v1 contracts (three-system, .length(3)).
• CLI --systems all expansion (still three systems; P5 owns the flip).
• ENGINE_VERSION (unchanged; P6 owns the bump to 0.3.0).
• All Western / BaZi / Zi Wei calculation algorithms and goldens (byte-identical to main).

ADR 0013 semantic defaults: still Proposed / BLOCKED

• Rahu default mean: proposed, owner confirmation pending (Open question 1).
• Vimshottari year model: BLOCKED / owner decision; candidate julian-365.25.
  P3 dasha implementation gated on this decision plus a same-model dual-implementation
  cross-check. The dashaYear enum is reserved in VedicSettings but no value is wired
  as a default anywhere.
• Vaara sunrise rule target: upper-limb proposed; backend parameter mapping requires
  P2 verification evidence before any Vaara output ships.

Dependency / supply-chain boundary

• Zero new runtime dependencies: pnpm-lock.yaml gains only two workspace importer entries.
• Swiss Ephemeris, PyJHora, node-jhora, external binaries or ephemeris data files have NOT
  been introduced into the repo, lockfile, bundle, SBOM or CI.
• SBOM package set (sbom.cdx.json / sbom.spdx.json) is byte-identical to main.

Verification (local, all green)

• pnpm install --frozen-lockfile passes (lockfile is the committed version).
• pnpm run verify:cloud — 19 stages green: format, lint, typecheck, 704 tests / 38 files,
  build, validate:provenance, validate:skill 40/40, validate:reading 53/53, validate:docs
  134/134, smoke, forward:test, package:hosts, verify:hosts, verify:install 106/106,
  check:doc-counts 12/12, scan:deps 0 advisories, scan:licenses 20/20, validate:sbom 96/96,
  scan:secrets.
• pnpm run build x2: engine.mjs / sbom.cdx / sbom.spdx SHA-256 zero drift.
• git diff --check clean.

Explicitly out of scope

No tag, no GitHub Release, no published assets, no manifest promotion.