docs(contrail-gh): document surface-diff tripwire and version tagging

[atdr]

What changed

Documents a surface-diff tripwire and a version-tagging scheme for
atdr/contrail-gh, contrail's companion template repo. This PR is docs-only —
the mechanism itself (surface-check.yml, tag-pin.yml, contrail-surface.json)
lands in a separate atdr/contrail-gh PR, which this doc describes and links to.

Why

Passport's new passport CLI subcommand slipped past docs/contrail-gh.md's
table because nothing mechanically flagged that contrail's public surface had
changed — reviewers had to remember to check by hand. This documents the fix:
contrail-gh's check-template.yml/check-instance.yml will diff CLI subcommands
and registry ids (importers/providers/storages/raw-logs) against a checked-in
contrail-surface.json on every pin-bump PR, and tag-pin.yml tags minor/major
bumps as vX.Y.Z (never patch-only, since bump-minor-pre-major /
bump-patch-for-minor-pre-major already make that split reliably mean
"feature/breaking" vs. "pure fix" while contrail is pre-1.0). Also rewords the "A
release is cut" table row, which previously implied merging the Dependabot PR was
sufficient on its own — it's the trigger, not the whole story.

Checks

• ./venv/bin/ruff check . and ./venv/bin/ruff format . — no Python changed
• ./venv/bin/pytest -q — no Python changed
• Docs updated in this PR (it is the doc)
• No behaviour changed, nothing to test
• Skimmed gh issue list; none of the open issues touch this change

Test plan

• npx prettier@3.9.6 --write docs/contrail-gh.md — ran via pre-commit hook,
  no formatting issues remained
• npx markdownlint-cli2 docs/contrail-gh.md — 0 issues
• Read the rendered file end-to-end to confirm the new table row, paragraph,
  and section read coherently with the existing doc

🤖 Generated with Claude Code

https://claude.ai/code/session_01X6VSeYrwoBr5FU8ZiwVDTn

[atdr]

Fixed a bug a review turned up in the contrail-surface.json regen recipe above: it imported RAW_LOGS and STORAGES unconditionally, which don't exist in contrail 0.4.0, the version contrail-gh currently pins. Following the recipe as written against that pin would ImportError instead of producing the null values the committed baseline (and surface-check.yml) already expect.

e73f433 mirrors surface-check.yml's optional_import helper in the recipe so it behaves the same way CI does against an older pin.

[atdr]

Pushed a follow-up commit (c0f1ee2) splitting the combined table row into three, to match the per-key guidance just added to surface-check.yml in contrail-gh#14:

• importer/emissions-provider id → default posture is "scaffold it" (env var wiring at minimum, directory/gitignore/guard if file-based)
• storage/raw-log id → same "wire it" instinct, but no repo-tree scaffolding by default
• CLI subcommand → no default posture at all — read what it does before deciding whether it needs template reaction (Passport is the worked example; a purely internal/diagnostic command wouldn't need one)

Reasoning: a single shared row treated a Passport-style feature the same as an internal registry becoming visible, which doesn't reflect how differently those should actually be handled. Formatted/linted clean (prettier, markdownlint-cli2).