Publish existing Run API contract

[wms2537]

Closes #49

What changed

• publishes the existing run-as-session/v1 Run create/resource/event JSON Schemas and checked compatibility fixtures
• adds authenticated contract discovery and stable fail-closed handling for unsupported versions
• validates real create/get/event HTTP responses against the packaged contract
• includes the contract bundle in the OCI image
• documents that Run completion does not imply a Kertas Outcome or Release

Why

Kertas needs a public, machine-readable compatibility boundary before the runtime introduces ManagedSession. This freezes the currently supported Run-as-session seam without exposing runtime storage or adding Kertas product state.

Review fixes

• added the full Run-events HTTP envelope
• aligned debugFaultPoints and UTC-only scheduledFor semantics with the existing route
• froze all always-returned Run fields and rejected unexpected product fields
• extracted shared validator setup and reused the event schema by reference

Validation

• npm run typecheck
• npm test — 58 files / 440 tests
• npm run release:gate — PASS at ccf3fa08319a162ed43a26b27f0feff124a62dc1
• npm audit --omit=dev — 0 vulnerabilities
• independent Standards review — PASS
• independent Spec review — PASS