feat(schemas): add software operational incident and upstream watch item contracts

[mdheller]

Summary

Adds the first machine-readable software operational risk contracts:

• SoftwareOperationalIncident
• UpstreamWatchItem

plus conforming example payloads.

Why here

Before writing, the current upstream README and schema catalog on main were checked. sourceos-spec is the canonical machine-readable contract layer, so this is the correct place to introduce the first incident and watchlist schemas downstream of the normative governance pack in SocioProphet/socioprophet-standards-storage PR #72.

Included

• schemas/SoftwareOperationalIncident.json
• schemas/UpstreamWatchItem.json
• examples/softwareoperationalincident.json
• examples/upstreamwatchitem.json

Notes

This PR intentionally starts with the minimum typed surface needed to support:

• normalized outage corpus records
• normalized upstream drift / watchlist records
• future harvester outputs in sociosphere
• later reserve / scenario envelopes

Follow-on

• extend the schema catalog index
• add reserve / scenario report envelopes
• add OpenAPI / AsyncAPI exposure where needed
• align downstream automation and runtime repos to these new schema types

[mdheller]

Follow-up added on the same branch after re-checking current upstream state:

• docs/software-oprisk-schema-family.md — documents the initial software operational risk schema family, URN prefixes, examples, and intended downstream consumers.

This keeps PR #24 as the single typed-contract lane for the first incident/watchlist schema set.