feat: add ForgeRail progressive adoption

[chasechou007]

Summary

• add progressive adoption contracts, Host Adapters, and read-only planning
• add portable and host-specific binding templates
• validate external Capability Packs, frozen AGW behavior, prerelease source, and disposable consumer lifecycle

Exact candidate

• head: b2ece8e860ae6fdb43619b40b9ecf9ab63e9713e
• parent/base: 6ca3837309bbc2f990cab7c11dcc831f24258d40
• tree: 97c754eb93bd5560b24fb82d96310e4c2ed99a43
• canonical source: 32c25b10c86e0c6de805f291ec52f685e994e1bf

Validation

• Plugin contracts and six Skills validated
• Stage 6 contracts: 25/25 tests and 4/4 manifests
• OpenSpec: 22/22
• workflow-equivalent Node 22 and Node 24 matrices passed
• npm pack dry-run matched the signed candidate; npm audit reported 0 vulnerabilities
• progressive-adoption planner confirmed no workspace mutations and no persisted .forgerail state

Approval boundary

This Draft PR is authorized only by the ForgeRail progressive-adoption remote_integration_approval. It does not authorize Ready transition, merge, tag, npm publication, GitHub Release, repository-policy changes, AGW lifecycle changes, or OpenSpec archive.