ManifestPayload leaks internal/registry types to public API

[I-am-nothing]

Problem

`system.ManifestPayload` is a public type, but several of its fields are typed using identifiers from `internal/registry`:

Field	Type
`Routes`	`map[registry.Scope][]registry.Route`
`Schedules`	`[]registry.Schedule`
`Tasks`	`[]registry.Task`
`Permissions`	`[]registry.Permission`
`Dependencies`	`[]registry.Dependency`

The Go `internal/` convention means external consumers cannot import these type names explicitly. Any downstream code that type-asserts or reflects over `ManifestPayload.Dependencies` at the concrete-type level gets a compile error.

Today this mostly doesn't hurt because consumers only JSON-encode/decode the payload, but it's a latent obstacle.

Options

1. Mirror structs in `system` — define `system.Dependency`, `system.Route`, `system.Schedule`, `system.Task`, `system.Permission`, `system.Scope` with identical JSON tags. `ManifestHandler` converts at the boundary.
2. Move the struct types out of `internal/` — promote to a top-level public package like `ms/modulespec` or similar.

Option 1 is less invasive but doubles the type count. Option 2 is cleaner long-term.

Out of scope

Not introduced by any specific PR — this is a pre-existing pattern across the SDK. Flagged during the code review on PR #87.