Add Agent Machine and Office Plane conformance fixtures

[mdheller]

Summary

Adds workstation/CI conformance coverage for the SourceOS Agent Machine mount plane and Prophet Workspace Office Plane dry-run path.

This repo remains a contract/conformance lane only. It does not run mounts, create Office artifacts, invoke LibreOffice, or act as a workspace controller.

Changes

• Adds a good conformance fixture:
  • conformance/good/agent-machine-office-dry-run.json
• Adds bad conformance fixtures:
  • conformance/bad/agent-machine-whole-home-mount.json
  • conformance/bad/agent-machine-unscoped-downloads.json
  • conformance/bad/office-raw-apple-app-db.json
• Extends tools/validate_contract.py semantic checks to reject:
  • $HOME / ~ as whole-home Agent Machine mount roots;
  • unscoped ~/Downloads browser download mounts;
  • raw Apple app DB/library access for Notes, Photos, Reminders, or Voice Memos;
  • Agent Machine lanes missing agent-machine.mount.evidence;
  • Office Plane lanes missing office.artifact.evidence.
• Updates README with the new conformance lane and non-goals.

Boundary

Valid path:

sourceosctl agent-machine mounts plan -> scoped mount evidence
sourceosctl office ...                -> OfficeArtifact-compatible dry-run/evidence
agent-term office ...                 -> governance-preserving operator event
AgentPlane                            -> AgentMachineMountEvidence / OfficeArtifactEvidence

Invalid paths now covered:

sourceosctl agent-machine mounts plan --dev-root $HOME
sourceosctl agent-machine mounts plan --downloads-root ~/Downloads
sourceosctl office inspect ~/Library/.../NoteStore.sqlite

Validation

Expected repo validation:

make validate