Capability-based model routing in the portable contract

[SollanSystems]

Reference skills may name Claude tiers, but the portable contract must not (ADR 0001 consequence 5).

Scope:

• model_policy maps roles (read/reason/write/verify) to capabilities (fast_low_cost, deep_reasoning, code_generation, independent_review).
• Provider profiles resolve capabilities to actual models outside the contract.
• plan@1 embeds capabilities only; recorded model resolution goes to receipts for reproducibility.

[SollanSystems]

Delivered by PR #61 (plan@1 + plan-lint, squash 157c31b) with resolution recorded per dispatch:

• schemas/plan.schema.json model_policy maps the four roles verbatim: read/reason/write/verify → fast_low_cost/deep_reasoning/code_generation/independent_review. The portable contract names capabilities only — no Claude tier appears in plan@1 (ADR 0001 consequence 5).
• Provider resolution lives outside the contract in the runner (e.g. the governed dispatch lane's route selection), and the actual resolved model is recorded per dispatch in receipts (.loop/receipts/*.jsonl model field; lane receipts carry intended/actual model + provider) for reproducibility.
• loop plan-lint validates the capability vocabulary in both validation modes.