feat: define lock, provenance, exception, and update policy

[szmyty]

Summary

• define the closed egohygiene.pace.lock/v1 JSON contract for foundation, Aether, workflow, container, site, and schema dependencies
• record immutable source references and SHA-256 digests, generated ownership, compatibility and migration state, rollback behavior, and bounded exceptions
• add a standard-library-only offline validator, a six-kind example, adversarial contract tests, and a least-privilege CI gate
• document the future reviewed-update sequence while keeping resolution and repository mutation outside this issue's authority boundary

Validation

• python3 scripts/validate_lock.py examples/pace.lock.json --as-of "2026-08-22T00:00:00Z"
• python3 -m unittest discover --start-directory tests --pattern "test_*.py" --verbose (10 tests)
• Python compile check
• JSON and workflow YAML parse checks
• inline Bash syntax check
• git diff --check

Closes #1

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress