feat(spec): add node-substrate immutable profile contracts

[mdheller]

Summary

Adds the first SourceOS machine-readable immutable-node contract tranche, explicitly framed as node / agent-runtime substrate work rather than desktop-owned work.

Added

Schemas:

• schemas/ImmutableNodeProfile.json
• schemas/HostCapabilityPlacement.json
• schemas/NodeStateSchema.json

Examples:

• examples/immutablenodeprofile.json
• examples/hostcapabilityplacement.json
• examples/nodestateschema.json

Validation/docs:

• tools/validate_immutable_node_examples.py
• docs/contract-additions/immutable-node-profiles.md

Boundary

• ImmutableNodeProfile is a node / agent-runtime substrate contract.
• Agent Machine and AgentPlane are primary downstream consumers.
• Desktop, shell, and workstation surfaces are consumers only; they may display summarized posture or expose operator controls.
• Optional Socios capability packs remain optional and do not make Socios a base SourceOS dependency.
• substrate.sociosRequired is constrained to false.

Validation

Focused validator:

python3 tools/validate_immutable_node_examples.py

Upstream state

This branch is additive but may need replay onto latest main before merge because upstream is moving quickly.

Follow-on work

1. Wire the validator into Makefile.
2. Index the schemas in schemas/README.md and ARCHITECTURE.md.
3. Add Agent Machine renderer/validator support.
4. Add sourceosctl immutable-node plan|validate|inspect in sourceos-devtools.
5. Register cross-repo topology edges in sociosphere.