feat: add versioned orchestration role contracts

[leynier]

Summary

• Add bounded, portable v1 role contracts with immutable snapshots, validated inputs and stable content digests.
• Require structured results, artifact declarations and checklist evidence before atomic completion; preserve legacy tasks and failure reporting.
• Add explicit contracted creation through CLI/RPC and frozen worker context without changing strict protocol versions or profile/model selection.

Validation

• Current head 258d119d, immediate parent 19864a4f (feat: add global orchestration run board #594). Full make rust-test, root/mobile analysis, 57 Flutter tests including 8 goldens, formatting, max-lines and actionlint passed.
• Root/mobile regeneration reproduced the parent's Dart outputs exactly. Schema limits, snapshots, restart, migration, completion and CLI/host cases passed locally.
• Codex gpt-5.6-sol high review iteration 2 passed without findings against workflows/03-board; 274 core and 113 CLI orchestration tests passed in review. Current-head PR Checks, CodeQL, Mobile Builds and Windows PTY passed. Five Windows process-job cases ran successfully; zero open security alerts.
• Full desktop matrix remains required at the final stack SHA under the approved risk-based policy; earlier cancelled runs are not current evidence.

Notes

Layer 4 of 10; remains draft. No UI or FRB API changes. Contracts validate reported evidence, not artifact contents or the truth of worker claims. Catalogs, reviewed plans, human gates and isolated integration remain separate layers. The pinned-v0.49.0 CI test verifies unsupported contracted creation leaves no task behind.