Ship Citadel app contracts and durable operation graphs

[SethGammon]

Summary

• Add dependency-free Citadel App v1 contracts and a browser-safe supervisor client boundary.
• Add durable Operation Graph contracts, deterministic scheduling, journals, effect recovery, guarded CLIs, and Research integration.
• Document the public ownership boundaries and ignore per-machine workspace, discovery, and linked-worktree state.
• Add generated-schema parity, lifecycle, privacy, recovery, runner, and end-to-end proof coverage.

Verification

• node scripts/test-all.js
• Result: all Citadel harness gates passed in 235 seconds.
• Citadel-Studio consumer: typecheck passed, 228 tests passed, web build passed, and Electron compilation passed.

Notes

• The already-merged PR 210 telemetry patch was automatically skipped during rebase.
• Generated local proof bundles and workspace state are not included.