feat: validator, bundle builder and release checks for 0.1.0

- Add tools/validate.py: validates packages, and with --correction runs
  proposed corrections through the gate against a package without
  writing anything (spec/11 §11.4). The gate now refuses a proposal that
  fails the correction schema, rule correction.schema.
- tools/load.py validates every package before loading, and with
  --bundle --built-from builds a scienting-bundle/1 with the FTS5 search
  index and bundle_meta (spec/13 §13.5). Search rows are defined per
  unit (sentence, cell, equation outside a sentence, figure-text) with
  the parent kind as context.
- Roster keys carry a role, and a key with the role owner may revoke any
  receipt (spec/08 §8.7, spec/20); roster schema, store table and the
  fixture roster updated. The checker signs a trial revocation to prove
  the rule both ways.
- A qa: receipt raises the nodes it sampled except those in its errors
  (spec/08 §8.2); the example paper's fidelity counts become 27 F3,
  13 F2, 4 F1 and 1 F0.
- The destination chooses the keyed scheme, not the text policy:
  hmac-team between the team's machines, hkdf-pages outside the team
  (spec/05 §5.8, spec/12 §12.5).
- A TextQuoteSelector must repeat the anchor's plain quote and is absent
  for hashed or keyed anchors (spec/18 §18.3).
- Add fixtures/records/suspect.json, a scienting-suspect/1 record.
- Oracle: hashes are kept incrementally and checked after every
  correction against a full recomputation; load and write refuse unsafe
  manifest paths; Ed25519, HKDF and schema validation come from the
  cryptography and jsonschema packages; canonical JSON uses the built-in
  encoder with an exact RFC 8785 fallback.
- The tools need Python 3.14 with cryptography and jsonschema; the py310
  CI environment is dropped and the workflow runs the default only.
- Resolve every [CHECK] note in the docs, READMEs and context; add
  CONTRIBUTING.md; every tool answers --help and refuses unknown options.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

sql/README.md

@@ -28,9 +28,10 @@ psql -d lab -f sql/doc.sql && psql -d lab -f sql/store.sql
 dolt sql < sql/doc.sql && dolt sql < sql/store.sql
 ```
 
-[CHECK: the sqlite3, psql and dolt commands were not run here; the PostgreSQL database `lab` and the Dolt repository must already exist.]
+The PostgreSQL database `lab` and the Dolt repository must already exist.
+The `sqlite3` line runs as shown; the `psql` and `dolt` lines follow the portability rules of [chapter 13](../spec/13-database.md#131-portability) but have not been run on those engines in this repository.
 
-To load packages into SQLite with nothing installed but Python 3, run `python3 tools/load.py --sqlite lab.db PACKAGE…`.
+To load packages into SQLite without pixi, run `python3 tools/load.py --sqlite lab.db PACKAGE…` with Python 3.14 and two packages, `jsonschema` and `cryptography` installed.
 The file [docs/examples.md](../docs/examples.md#load-packages-into-sqlite) has queries to try.
 The loader copies files that have no table (assets, dataset files, derived files) by SHA-256 into `lab.db.assets/`.
 

sql/bundle-sqlite.sql

@@ -9,9 +9,10 @@ CREATE TABLE bundle_meta (
   PRIMARY KEY (name)
 );
 
--- One row per searchable unit: a sentence, an equation outside a sentence, a cell, or a figure-text item.
--- `context` is the kind of the sentence's container: paragraph, heading, caption, footnote and so on.
--- `text` is the normalized plain projection; withheld text is never indexed.
+-- One row per searchable unit: a sentence, a cell, an equation outside a sentence, or a figure-text item.
+-- `unit` is sentence, cell, equation or figure-text. `context` is the kind of the node's parent:
+-- paragraph, heading, caption, footnote, row and so on. A figure-text item names its panel as `node`
+-- and its role as `context`. `text` is the normalized plain projection; withheld text is never indexed.
 CREATE VIRTUAL TABLE search USING fts5(
   doc_key UNINDEXED,
   node UNINDEXED,

sql/store.sql

@@ -7,6 +7,7 @@ CREATE TABLE roster_keys (
   store VARCHAR(128) NOT NULL,
   id VARCHAR(128) NOT NULL,
   person TEXT NOT NULL,
+  role VARCHAR(16) NOT NULL CHECK (role IN ('owner', 'editor', 'reader', 'guest')),
   scheme VARCHAR(16) NOT NULL CHECK (scheme IN ('ed25519', 'ssh', 'gpg', 'sigstore')),
   public_key TEXT NOT NULL,
   purposes TEXT NOT NULL,