feat(techvault): declare Cortex job index as ADR-088 initial service state

[Brad-Edwards]

Summary

Converts the TechVault cortex-index-init one-shot init node into an ADR-088 initial service state declaration. The Cortex job index is now declared as observable state: a materialization-only content entry (cortex-job-index-schema) with a service-search-index-schema profile targeting thehive-es, declaring only portable key/status/relations = exact-token field semantics plus readback scaffolding. The backend's native Elasticsearch materializer establishes and proves the field schema before Cortex starts — no separate init container, and no native index name or vendor ES literals in the SDL. The cortex_6 datastore partition on thehive-es (ADR-048, the observed half) is unchanged; this adds the materialized half (ADR-088). Unblocks Brad-Edwards/aptl#889; the feat type triggers the release-please version bump aptl pins.

This PR also folds in a pre-existing, repo-wide dependency-audit fix (see Changes): cryptography 49.0.0 → 50.0.0 for CVE-2026-69247, which the audit/verify CI gates flagged. It is transitive (via raes/asyncssh/pyjwt) and already red on dev; fixed here rather than deferred.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #268

ADR Impact

• ADR-088
• ADR-048
• ADR-036
• ADR-021

Changes

• Remove the cortex-index-init one-shot vm node, its inline cortex-index-init-script content, and its infrastructure topology row (nothing else referenced it).
• Add materialization-only content.cortex-job-index-schema (dataset, target thehive-es) with the service-search-index-schema profile, target_service_ref: nodes.thehive-es.services.elasticsearch, and exact-token field semantics for key/status/relations.
• Add readback scaffolding — propositions, assertions, observation_boundaries, evidence_requirements — mirroring the RAES initial-service-state example; the evidence requirement carries the RAES-3.3.0-required integrity/retention/loss_disclosure fields the issue snippet omitted.
• Rebind the SDL byte digest (checksum + size + set_digest) in associated-artifacts.json via tools/refresh_pack_sdl_binding.py.
• Update tests/test_techvault_pack.py topology guards (node/infrastructure counts 38→37, content inline/sourced/materialized partition) and add test_cortex_job_index_schema_is_adr088_initial_service_state as a structural invariant guard.
• Security fix (CI audit gate): bump cryptography 49.0.0 → 50.0.0 in requirements/runtime.txt for CVE-2026-69247, with authoritative PyPI hashes; verified by a --require-hashes install + pip-audit (clean). cffi 2.1.0 already satisfies 50.0.0's cffi>=2.0.0; the frozen recovery-v2.0.2.txt snapshot is left untouched.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Full completion command green (812 tests + raes-pack-validate/release check across repo and packs) and policy command green. Pre-push codex and test-quality reviews both clean (0 findings). raes-pack-validate --pack packs/techvault confirms the SDL parses under the pinned raes 3.3.0 with the new materialization and readback sections. pip-audit against the updated closure reports no known vulnerabilities.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: ADR-088 ← packs/techvault/sdl/techvault.sdl.yaml
• TESTS: ADR-088 ← tests/test_techvault_pack.py::test_cortex_job_index_schema_is_adr088_initial_service_state

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Verified unchanged: no documentation surface in scope.