Standardize LSP traceability report contract

[newtontech]

Closes #233

Summary

• add the OpenQC LSP traceability report JSON schema and contract documentation
• add a TypeScript validator plus CP2K/DP-GEN fixture coverage for schemaVersion, serverId, rule ID format, and repo-relative paths
• teach check-lsp-family to report traceability schema compatibility failures clearly
• make check-lsp-family and check-lsp-latest resolve the real code root from .worktrees/* checkouts

Tests

• npm run compile
• npx jest tests/unit/smoke/traceabilityReport.test.ts --runInBand
• npm run lint (passes with existing curly warnings in unrelated files)
• npm run format:check
• node --check scripts/check-lsp-family.mjs && node --check scripts/check-lsp-latest.mjs
• node scripts/check-lsp-family.mjs --json --report-path /tmp/openqc-lsp-family-233.json
• npm run lsp:check-latest -- --fail-on-drift
• pre-commit: npm run test:unit (68 suites passed; 1424 passed, 2 skipped)

Notes

check-lsp-family now distinguishes rollout-missing reports from incompatible legacy reports. Current latest checkouts show old traceability schema failures for abacus-lsp and dpgen-lsp, which is the intended compatibility signal until those backend reports are regenerated with openqc.lsp.traceability.v1.