feat: carry authored OS identity through realization

[Brad-Edwards]

Summary

Carry authored operating-system family, distribution, and release constraints through compilation, coupled backend admission, and operation-bound guest observation so unsupported or substituted identities fail closed while open choices remain apparatus-bound.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #1077

ADR Impact

• ADR-009
• ADR-021

Changes

• Add governed OS distribution and release contracts with family-to-distribution-to-version dependencies across public schemas and fixtures.
• Compile exact, constrained, and open OS identity leaves into coupled feasible capability domains and resolved realization authority.
• Require typed guest-observed OS evidence bound to the operation, envelope, configuration, observer, and sequence before runtime realization succeeds.
• Expand scenario, conformance, formal replay, and rejection-path coverage, and split synchronized export and OCI image-policy modules to satisfy source-size policy.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Focused review-fix suites passed (89 OS/envelope/authority tests and 63 synchronized contracts/facade/OCI tests). The final origin/dev-synchronized tree passed verify-completion with 6,500 unit tests, integration/contracts/static/proof/docs lanes, 91% coverage, and the full repository policy suite.

Ground Control Checks

• Configured repository policy command passes
• Pre-push code review and test-quality review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/packages/raes_processor/compiler/realization_requirements.py, Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/packages/raes_processor/planner/operating_system_capability_domains.py, Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/packages/raes_contracts/realization_observation.py
• TESTS: Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/tests/test_issue_1077_os_identity_realization.py, Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/tests/test_sem_218_runtime_realization.py, Issue Carry authored OS distribution and version through realization admission and evidence #1077 ← implementations/python/tests/test_realization_envelope_contract.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.