feat: Prepare 0.5 public contracts and trusted migrations

[thossullivan]

Summary

• publish seven canonical Draft-07 document contracts, add the zero-dependency validate command, and build receipt-gated Pages output for schemas, feeds, health, and Atom
• make migration execution safer with plan-atomic apply, symlink and submodule coverage refusal, deterministic changed-line parsing, and fail-closed feed/spec validation
• keep repository eval code in the read-only evaluate phase and bind publication to the exact commit, plan, eval config, feed digests, and resolved package version
• preserve per-path provider/distributor clocks through repository policy, bot decisions, and channel-qualified CycloneDX components
• ingest Bedrock Public Extended Access/status transitions and make distributor status changes material refresh events
• make release recovery resumable and bind exact npm tarball integrity into post-publication package and Action UAT

Why

The 0.4 line proved that model retirement findings can drive isolated migration evaluation. This milestone turns the supporting evidence into a public, reusable contract and closes the correctness gaps found while UATing real repositories: silent scan omissions, partial apply behavior, lifecycle-clock collapse, privileged inline eval, stale automation state, and non-resumable release steps.

User and developer impact

• model-eol check --json now emits model-eol/check@0.1 and validates like the other public reports.
• model-eol validate covers feeds, repository config, check, inventory, schedule, alert, and plan documents.
• CycloneDX emits one component per canonical model and requested lifecycle channel instead of collapsing direct and distributor clocks.
• check and plan fail closed for tracked submodules, symlinks, invalid UTF-8, unsupported feed specs, and other incomplete coverage unless the user explicitly ignores or accepts it.
• Configured evaluation requires the split plan/evaluate/publish workflow; privileged inline --eval is removed with migration guidance.
• The supported Node floor becomes Node 22. The package retains zero runtime, development, peer, and optional dependencies.

package.json intentionally remains at 0.4.1 in this branch. The tested release workflow creates the isolated 0.5.0 version commit and tags.

Validation

• full npm test on the default runtime
• full npm test through Node 22
• all seven schemas and four bundled feeds validated through the public CLI
• packed-package consumer test for both binaries, check-to-validate round trips, isolated eval, and zero dependencies
• Action, workflow, release recovery, public-site receipt, and exact-byte verification contracts
• official CycloneDX 1.6 schema validation
• JavaScript syntax, workflow/template YAML parsing, npm pack dry run, and diff checks
• non-mutating real-repository UAT against model-eol, Switchyard, and developer-crew-ai

Post-merge release gates

1. Enable GitHub Pages with GitHub Actions as the source.
2. Dispatch feed-refresh from main; merge a generated feed PR first if it reports material drift.
3. Require the receipt-bound public-contract deployment and live exact-byte verification to pass.
4. Dispatch npm-release.yml once with release_version=0.5.0.
5. Require immutable npm/package/Action UAT and moving 0/v0 monitoring to pass.

Follow-on product work is tracked in #78 through #86.

Closes #6