fix(contracts): admit expanded scenario snapshot parents (#1040)

[doublewhy]

Plain-language summary

• Context: A runtime snapshot can record either an authored scenario or a fully expanded scenario as its parent artifact.
• Problem: The contract accepted an authored Scenario parent but rejected a valid, semantically checked ExpandedScenario parent, so a legitimate expansion could not be represented.
• Fix: Accept both validated parent forms while continuing to reject unvalidated, instantiated, or otherwise unsafe parent objects.

Summary

Admit semantically validated ExpandedScenario values as canonical scenario-snapshot parents for associated-artifact manifests. This keeps generic scenario references id-only, rejects unvalidated and instantiated objects, and makes the parser's public return annotation match its existing file-backed expansion behavior.

This is the focused successor for the expanded-scenario parent portion of the earlier aggregate work. It intentionally excludes evaluator and solver changes.

Related issues

Closes #1040

Changes

• accept validated Scenario | ExpandedScenario parents at the snapshot boundary
• preserve the existing generic scenario parent contract
• reject unvalidated authoring objects and InstantiatedScenario parents
• document the phase boundary, lineage, alternatives, and validation invariant
• cover exact expanded-parent success, digest mismatch, inadmissible phases, and generic-parent compatibility
• update parse_sdl() and parse_sdl_file() annotations to disclose their existing expanded return phase

Test plan

• Focused parser/contracts/phase suite: 140 passed, 1 skipped
• Associated-artifact branch-coverage run: 20 passed; changed _scenario_parent_matches() is 100% statement and branch covered
• Change-aware pre-commit gate, including Ruff, schema publication, generated-schema drift, contract graph, policy, and the changed test module
• Direct repository-policy and requirement-governance commands (Ground Control was unavailable, so its remote check reported the repository's documented non-gating skip)
• Canonical tools/verify_all.py completed all static, contracts, and docs lanes, but the repository-wide unit lane remains red in unchanged libvirt tests and the local proof lane lacks the pinned Isabelle archive. A representative libvirt-backend.techvault-native.operation-failed failure reproduces on exact base 3d6e369b.

Checklist

• Code follows the project coding standards
• FM level classified: FM1 static semantic phase-admission rule, with the invariant documented and unit-tested
• No published schema shape changes; generated schema and publication checks pass
• PR title is a Conventional Commit
• Contract and architecture rationale is documented

Notes for review

The branch is a single commit based directly on dev at 3d6e369b726607ff657a841c7f1dee0bec655b8f. The #1082 compute-kind change required updating the new test fixture from legacy type: vm to canonical type: compute; no realization semantics are changed here.