feat(reconciliation): add consumer contract

[Pigbibi]

Summary

• add strict qsl.reconciliation_record.v1 schema
• add dependency-free fail-closed validator and MISSING-only builder
• add synthetic tests for identity binding, observer evidence, status consistency, freshness, digest integrity, and sensitive-data rejection

Boundary

Contract/static acceptance only. No apply, readback, config sync, runtime mutation, provider or broker access, and no MATCHED claim or observed identity was produced.

Validation

• 165 QRT unit tests
• 34 DeploymentBundle + Activation + Reconciliation compatibility tests
• fresh 14-repository dependency matrix: 30 files, 0 missing, 0 issues
• Ruff, compileall, JSON Schema 2020-12 meta/fixtures, actionlint, Node syntax/assets
• temporary sdist/wheel build
• exact three new paths, static secret scan, zero deploy-path overlap

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f3fce48856

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".