contracts: add shared content/build/release family

[mdheller]

Summary

This PR adds the first shared content/build/release object family to sourceos-spec.

It is intended as an additive contract layer that can be reused across:

• SourceOS artifact definitions and release lanes
• socios build / promotion automation
• workstation execution and evidence flows
• office/editor export and publication lanes
• platform bundle publication
• catalog and promotion surfaces

What lands

Design note

• docs/contract-additions/shared-content-build-release-family-v0.md

New schemas

• schemas/ContentSpec.json
• schemas/OverlayBundle.json
• schemas/BuildRequest.json
• schemas/ReleaseManifest.json
• schemas/EnrollmentProfile.json
• schemas/EvidenceBundle.json
• schemas/CatalogEntry.json
• schemas/AccessProfile.json

Why here

sourceos-spec already defines itself as the canonical machine-readable contract layer for SourceOS/SociOS, including additive agent-plane and fog-plane families.

That makes it the correct place to introduce a cross-domain object family that can be referenced by:

• substrate/build lanes
• execution planes
• catalog/index surfaces
• publication/export surfaces

Important boundary notes

This PR does not replace existing families such as:

• ReleaseReceipt
• RunRecord
• PolicyDecision
• CapabilityToken
• fog-layer contracts
• agent-plane contracts

Instead, it provides a shared object language that those families and downstream repos can reference.

Follow-on after this

1. add example payloads and fixture validation
2. bind workstation, execution, and catalog surfaces to this family
3. add explicit transport-boundary notes for local subprocess IPC vs remote TriTRPC transport