feat(impl-p00-003a): deliver waveform contract foundation and cache profile

[yutthaphon]

Summary

Delivers VID-IMPL-P00-003A: Recoverable Waveform Contract and Cache Foundation (sub-slice).

Establishes canonical waveform operation contract, cache-key profile, deterministic bulk
integrity (whole-object SHA-256 only), exact state/error reconciliation mapping, and
resource/policy/retry bounds. Synthetic no-media fixture coverage for admission, descriptor
vectors, handle safety, cache lifecycle, and reconciliation.

Accepted Architecture

• Luna Review (ACCEPT): .agents/reviews/VID-IMPL-P00-003A/luna-architecture-c2.md
• Primary Architecture Disposition (ACCEPTED_FOR_IMPLEMENTATION):
  .agents/reviews/VID-IMPL-P00-003A/primary-architecture-acceptance.md
• Primary Implementation Disposition (ACCEPTED_C9_FOR_PUSH):
  .agents/reviews/VID-IMPL-P00-003A/primary-implementation-acceptance.md
• Architecture Status: C2 Accepted; C3 Implementation Authorized; C4 Implementation Complete
• Authority: OWNER-AUTH-V2

Test Evidence (C9 Finalized)

• Test Suite: 23/23 tests passing (cargo test --test waveform_contract)
• Hash Closure: 27/27 files verified (contract schemas, profiles, fixtures, worker source/tests, evidence, and scoped .gitattributes)
• Multi-Reviewer Consensus: Terra (C8), Luna (C9), Sonnet (C9), Gemini security (C4, no C5-C9 review) — all ACCEPT with 0 P0/P1 findings

Scope: VID-IMPL-P00-003A (Sub-Slice of Issue #30)

Included:

• Waveform contract schemas and profiles (10 schemas + 5 records + 3 profiles + 3 fixtures)
• Deterministic RFC 8949 CBOR cache-key derivation (sui.cache-key.cbor-sha256.v1)
• Whole-object-only bulk integrity profile
• Exact waveform error state reconciliation (24-row taxonomy with terminal success journal authority)
• Resource/policy/retry bounds (30s timeout, 256MB input, 512MB payload, 2 attempts, 500ms retry)
• Worker implementation: waveform_contract.rs with comprehensive test coverage (23 test cases)
• Evidence: test-report.json, manifest.json, fixture inventory, and scoped .gitattributes

NOT Included:

• Real ffprobe execution or verification (VID-IMPL-P00-003B; separate decision gate)
• Media parsing/decoding (out of scope)
• UI rendering or playback (out of scope)
• FFmpeg redistribution (external-only)
• Phase 00 exit or support claims
• VID-DEC-005/003B candidates (excluded from this commit)

Relates to Issue #30

This PR delivers the contract and cache foundation sub-slice (VID-IMPL-P00-003A) of
the parent issue #30 scope. Issue #30 requires both:

1. ✅ VID-IMPL-P00-003A (this PR): Contract/cache foundation (C9 finalized)
2. ⏳ VID-IMPL-P00-003B (future gate): Real audio extraction

Issue #30 will remain OPEN after this PR merge, pending 003B completion.

Decision Gate: Real extraction requires explicit new decision via VID-DEC-005
(VID-DEC-003@1.0 is probe-only; does not authorize waveform extraction).

Acceptance Criteria Verified

• ✅ Dependencies and stable IDs linked (for 003A contract/cache scope)
• ✅ Observable acceptance evidence recorded (23/23 tests + 27/27 hash closure)
• ✅ Security/compatibility/recovery/Windows/EN-TH/theme/accessibility impacts handled (for 003A)
• ✅ C9 corrections applied (fixtures, manifest records, test evidence, line-ending policy)
• ✅ No 003B candidates committed
• ✅ No generated target/ files tracked

🤖 Generated with Phase 00 Delivery Automation