Define and prove provider capability portability

[wms2537]

Closes #30

Outcome

• publishes 11 versioned model, sandbox, object, event, credential, knowledge, memory, Skill, and MCP contracts
• declares complete required/optional/unsupported subsets for local, BytePlus, and a deliberately narrow AWS public-S3 reader
• exposes authenticated capability discovery and resolution for Kertas without provider-name inputs
• propagates assurance, failure boundaries, and limitations into checked deployment bindings
• enforces object-store affinity and fails closed on unknown or unsatisfied capabilities
• packages the checked catalog/manifests/evidence into the controlled-alpha OCI image
• records provider portability as a machine-readable step inside the existing release gate

Honest evidence boundary

• BytePlus: retained live ModelArk, private veFaaS sandbox, and TOS evidence only; the ModelArk receipt reports 48 output tokens for a 32-token request, so the contract claims request forwarding rather than provider enforcement
• AWS: anonymous read-only HEAD/GET against the NOAA GOES-16 AWS Open Data bucket; no write, presign, list, authenticated access, availability, or performance claim
• local: integration reference; child-process sandbox is explicitly not an isolation boundary

Verification

• exact clean npm run release:gate at dacc6557cfa48a04a7f2d55ef9f618b8e1d8b283
• provider portability, production dependency audit, typecheck, and full Vitest evidence all passed
• clean OCI build and migration/API/worker/relay smoke contract (provider assets loaded in the runtime image)
• independent standards review: PASS
• independent issue P1: Define and prove the runtime provider portability boundary #30 spec review: PASS

Live AWS receipt

provider-conformance/evidence/aws-s3-public-read-2026-07-22.json (SHA-256 f4e1596430bc02b83810dbef93d9a8dcdbc1e4261cb72a2d952d5178e1cc568f)