Add onboarding control-plane contracts

[mdheller]

Summary

Adds the first SourceOS/SociOS onboarding control-plane contract family.

This introduces additive schemas for:

• WorkspaceScope
• TrustMode
• CapabilityPack
• ConnectorActionScope
• AutomationTemplate
• OnboardingReceipt

These contracts support role/workspace/trust-mode onboarding, capability-pack catalogs, connector action scopes, scheduled automation templates, and first-run/workspace setup receipts.

Design intent

This PR formalizes the control-plane objects needed by SourceOS Shell, Sociosphere, Agentplane, Ontogenesis, and Prophet Platform so agent onboarding is visible, scoped, revocable, and receipted.

It intentionally reuses existing contract families:

• AgentSession remains the session object.
• ExecutionSurface remains the runtime/sandbox/network/worktree envelope.
• SkillManifest remains the narrow skill declaration.
• Connector remains the configured connector.
• SessionReceipt remains the final session receipt.

The new schemas add composition and ceremony layers around those existing primitives.

Included

• Six schemas in schemas/
• Six first-run/read-only examples in examples/
• tools/validate_onboarding_examples.py
• validate-onboarding-examples Makefile target wired into make validate
• ADR-0012 documenting the contract decision
• semantic/sourceos-onboarding-vocabulary.jsonld
• Changelog and semantic README updates
• docs/contract-additions/onboarding-control-plane.md

Validation

• Schema/example payloads checked with Python jsonschema while composing this slice
• Added make validate-onboarding-examples
• Wired onboarding validation into top-level make validate
• GitHub CI / repository make validate
• make jsonld — no target is present in the current Makefile
• make all — no target is present in the current Makefile

Follow-up

• Update schemas/README.md quick-reference/catalog entries in a focused follow-up or reviewer-requested commit; this PR adds a dedicated contract-additions note and avoids a risky full catalog rewrite through the connector.
• Add Ontogenesis RDF/SHACL semantics.
• Add Sociosphere workspace fixtures and onboarding validator.
• Add Agentplane onboarding receipt integration.
• Add SourceOS Shell onboarding UI stubs.
• Add Prophet Platform evidence-console binding.