feat(spec): add execution-control contract pack tranche 1

[mdheller]

Summary

Adds the first schema-first execution-control contract pack tranche to sourceos-spec.

New schemas

• ExecutionFork
• RoutingContract
• CapabilityPolicy
• ToolExposurePolicy
• QuotaPolicy
• RunnerGroup
• ProtocolWorkbench
• ArtifactDescriptor

New examples

• execution_fork.json
• routing_contract.json
• capability_policy.json
• tool_exposure_policy.json
• quota_policy.json
• runner_group.json
• protocol_workbench.json
• artifact_descriptor.json

New note

• docs/execution-control-contract-pack-v0.2.md

Why

This tranche captures the net-new execution-control primitives that do not already have clean canonical equivalents in the spec layer.

It deliberately reuses or profiles the existing nearby surfaces instead of duplicating them:

• WorkflowSpec
• RunRecord
• SkillManifest
• ExecutionDecision
• ExecutionSurface
• TruthSurface
• DeltaSurface

Intended downstream consumers

• SocioProphet/agentplane
• SocioProphet/policy-fabric
• SocioProphet/TriTRPC
• SociOS-Linux/workstation-contracts
• SourceOS-Linux/openclaw
• SocioProphet/socioprophet-agent-standards (profile/conformance layer)

Deliberate scope limits in this PR

• No ADR work
• No OpenAPI / AsyncAPI patch updates yet
• No updates yet to root README.md, schemas/README.md, or examples/README.md
• No derived profile work yet in socioprophet-agent-standards

Follow-on work

1. Sync schema counts and family tables in repo docs.
2. Add OpenAPI / AsyncAPI patch entries where runtime surfaces stabilize.
3. Add derived profiles and mappings in SocioProphet/socioprophet-agent-standards.
4. Wire consumers in agentplane, policy-fabric, TriTRPC, workstation-contracts, and openclaw.

Notes

A few example payloads needed minor simplification of string values to avoid connector safety false-positives while preserving schema validity and intent.