feat: validator, bundle builder and release checks for 0.1.0

- Add tools/validate.py: validates packages, and with --correction runs
  proposed corrections through the gate against a package without
  writing anything (spec/11 §11.4). The gate now refuses a proposal that
  fails the correction schema, rule correction.schema.
- tools/load.py validates every package before loading, and with
  --bundle --built-from builds a scienting-bundle/1 with the FTS5 search
  index and bundle_meta (spec/13 §13.5). Search rows are defined per
  unit (sentence, cell, equation outside a sentence, figure-text) with
  the parent kind as context.
- Roster keys carry a role, and a key with the role owner may revoke any
  receipt (spec/08 §8.7, spec/20); roster schema, store table and the
  fixture roster updated. The checker signs a trial revocation to prove
  the rule both ways.
- A qa: receipt raises the nodes it sampled except those in its errors
  (spec/08 §8.2); the example paper's fidelity counts become 27 F3,
  13 F2, 4 F1 and 1 F0.
- The destination chooses the keyed scheme, not the text policy:
  hmac-team between the team's machines, hkdf-pages outside the team
  (spec/05 §5.8, spec/12 §12.5).
- A TextQuoteSelector must repeat the anchor's plain quote and is absent
  for hashed or keyed anchors (spec/18 §18.3).
- Add fixtures/records/suspect.json, a scienting-suspect/1 record.
- Oracle: hashes are kept incrementally and checked after every
  correction against a full recomputation; load and write refuse unsafe
  manifest paths; Ed25519, HKDF and schema validation come from the
  cryptography and jsonschema packages; canonical JSON uses the built-in
  encoder with an exact RFC 8785 fallback.
- The tools need Python 3.14 with cryptography and jsonschema; the py310
  CI environment is dropped and the workflow runs the default only.
- Resolve every [CHECK] note in the docs, READMEs and context; add
  CONTRIBUTING.md; every tool answers --help and refuses unknown options.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

fixtures/invalid/bad-id/package/MANIFEST.json

@@ -1 +1 @@
-{"doc":"scienting-doc/1","files":[{"path":"document.json","sha256":"20a7d6ba83bf42a87e44f3b3f96bfb16ff545b199d82e54d3c17989e465281df","size":555},{"path":"nodes.jsonl","sha256":"7f531bc7549887e8d18a0b31a91752912f2c20b26521cf3d8d97180019773324","size":11295},{"path":"provenance.json","sha256":"b1af404b3a07d4b102f0a45237285315dc1ff60f243636c22aef3e1c20b46912","size":224},{"path":"receipts.jsonl","sha256":"e6be2c6ff4d1444e2faf75c8c4d03482ceaf49746ea390592928b2b5e3b22237","size":2180},{"path":"references.jsonl","sha256":"bb5445037c28bf5fde215b4b831c29327dec6dd88259e2d53aabb995f2fdb98f","size":60},{"path":"roster.json","sha256":"d5c14bada3b9b61e71c91f2f9f8dbd7eeb84b3e0b4256748e655821aaba326bd","size":861},{"path":"witnesses.json","sha256":"83ac4411c2efe65e0f7fc4c9336abbef6977cd32b0f90de029a7f8516afc3e97","size":750}],"format":"scienting-package/1","key":"tiny2026example"}
+{"doc":"scienting-doc/1","files":[{"path":"document.json","sha256":"20a7d6ba83bf42a87e44f3b3f96bfb16ff545b199d82e54d3c17989e465281df","size":555},{"path":"nodes.jsonl","sha256":"7f531bc7549887e8d18a0b31a91752912f2c20b26521cf3d8d97180019773324","size":11295},{"path":"provenance.json","sha256":"b1af404b3a07d4b102f0a45237285315dc1ff60f243636c22aef3e1c20b46912","size":224},{"path":"receipts.jsonl","sha256":"e6be2c6ff4d1444e2faf75c8c4d03482ceaf49746ea390592928b2b5e3b22237","size":2180},{"path":"references.jsonl","sha256":"bb5445037c28bf5fde215b4b831c29327dec6dd88259e2d53aabb995f2fdb98f","size":60},{"path":"roster.json","sha256":"7ee0c38fb4fdfc15d4ffa8139a239c23082dc69f8147c5920a39e8361cc7bbeb","size":924},{"path":"witnesses.json","sha256":"83ac4411c2efe65e0f7fc4c9336abbef6977cd32b0f90de029a7f8516afc3e97","size":750}],"format":"scienting-package/1","key":"tiny2026example"}

fixtures/invalid/bad-id/package/roster.json

@@ -1 +1 @@
-{"format":"scienting-roster/1","keys":[{"id":"ana","person":{"name":"Ana Example"},"public":"KaptcVSRRjQ1EaRm7sWY+ExKeNtrQ5Xny7G0sOQq1Rc=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"scheme":"ed25519"},{"id":"ben","person":{"name":"Ben Example"},"public":"FTgWcu94E4B07ky4Sd2W6VcMzamQgx8G7v++3Y/jvfY=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"scheme":"ed25519"},{"id":"ben-spot","person":{"name":"Ben Example"},"public":"Z9Kcdd6RARODR/eUTI0yTXQkue0/K6ehrInEtAfGrzI=","purposes":["spot-check"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"scheme":"ed25519"},{"id":"cara","person":{"name":"Cara Example"},"public":"J8HPVPYtxYbKQZLMnlvND2FeGrhHj/RN8fLQ0MeyKCc=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"scheme":"ed25519"}],"store":"smithlab"}
+{"format":"scienting-roster/1","keys":[{"id":"ana","person":{"name":"Ana Example"},"public":"KaptcVSRRjQ1EaRm7sWY+ExKeNtrQ5Xny7G0sOQq1Rc=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"role":"owner","scheme":"ed25519"},{"id":"ben","person":{"name":"Ben Example"},"public":"FTgWcu94E4B07ky4Sd2W6VcMzamQgx8G7v++3Y/jvfY=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"role":"editor","scheme":"ed25519"},{"id":"ben-spot","person":{"name":"Ben Example"},"public":"Z9Kcdd6RARODR/eUTI0yTXQkue0/K6ehrInEtAfGrzI=","purposes":["spot-check"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"role":"editor","scheme":"ed25519"},{"id":"cara","person":{"name":"Cara Example"},"public":"J8HPVPYtxYbKQZLMnlvND2FeGrhHj/RN8fLQ0MeyKCc=","purposes":["sign"],"registered_at":"2026-09-01T00:00:00Z","revoked_at":null,"role":"reader","scheme":"ed25519"}],"store":"smithlab"}