feat: validator, bundle builder and release checks for 0.1.0

- Add tools/validate.py: validates packages, and with --correction runs
  proposed corrections through the gate against a package without
  writing anything (spec/11 §11.4). The gate now refuses a proposal that
  fails the correction schema, rule correction.schema.
- tools/load.py validates every package before loading, and with
  --bundle --built-from builds a scienting-bundle/1 with the FTS5 search
  index and bundle_meta (spec/13 §13.5). Search rows are defined per
  unit (sentence, cell, equation outside a sentence, figure-text) with
  the parent kind as context.
- Roster keys carry a role, and a key with the role owner may revoke any
  receipt (spec/08 §8.7, spec/20); roster schema, store table and the
  fixture roster updated. The checker signs a trial revocation to prove
  the rule both ways.
- A qa: receipt raises the nodes it sampled except those in its errors
  (spec/08 §8.2); the example paper's fidelity counts become 27 F3,
  13 F2, 4 F1 and 1 F0.
- The destination chooses the keyed scheme, not the text policy:
  hmac-team between the team's machines, hkdf-pages outside the team
  (spec/05 §5.8, spec/12 §12.5).
- A TextQuoteSelector must repeat the anchor's plain quote and is absent
  for hashed or keyed anchors (spec/18 §18.3).
- Add fixtures/records/suspect.json, a scienting-suspect/1 record.
- Oracle: hashes are kept incrementally and checked after every
  correction against a full recomputation; load and write refuse unsafe
  manifest paths; Ed25519, HKDF and schema validation come from the
  cryptography and jsonschema packages; canonical JSON uses the built-in
  encoder with an exact RFC 8785 fallback.
- The tools need Python 3.14 with cryptography and jsonschema; the py310
  CI environment is dropped and the workflow runs the default only.
- Resolve every [CHECK] note in the docs, READMEs and context; add
  CONTRIBUTING.md; every tool answers --help and refuses unknown options.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tools/oracle/receipts.py

@@ -123,7 +123,9 @@ def revoked(receipt, revocations):
     return False
 
 
-def valid_revocations(revocations, receipts_by_id, roster, owners):
+def valid_revocations(revocations, receipts_by_id, roster):
+    """The revocations signed by the receipt's signer, the signer they name, or a key the roster makes an owner."""
+    owners = {k for k, v in roster.items() if v.get("role") == "owner"}
     out = []
     for r in revocations:
         if not verify_signature(r, roster):
@@ -139,7 +141,7 @@ def valid_revocations(revocations, receipts_by_id, roster, owners):
     return out
 
 
-def receipt_status(rec, records, roster, owners=()):
+def receipt_status(rec, records, roster):
     """`valid`, `revoked`, `suspended`, or `invalid` for one receipt."""
     receipts = [x for x in records if x["format"] == "scienting-receipt/1"]
     revs = [x for x in records if x["format"] == "scienting-revocation/1"]
@@ -151,26 +153,30 @@ def receipt_status(rec, records, roster, owners=()):
     key = roster.get(rec["by"])
     if not key or not key_valid_at(key, rec["at"]) or rec["signature"]["key"] != rec["by"]:
         return "invalid"
-    if revoked(rec, valid_revocations(revs, by_id, roster, owners)):
+    if revoked(rec, valid_revocations(revs, by_id, roster)):
         return "revoked"
     for q in receipts:
         qa = q.get("qa")
         if qa and qa.get("of") == rec["id"] and qa.get("errors"):
-            if receipt_status(q, records, roster, owners) == "valid":
+            if receipt_status(q, records, roster) == "valid":
                 return "suspended"
     return "valid"
 
 
-def effective_levels(nodes, values, records, roster, owners=()):
-    """Every leaf's level: its recorded level, raised by valid receipts that list it at its current hash."""
+def effective_levels(nodes, values, records, roster):
+    """Every leaf's level: its recorded level, raised by valid receipts that list it at its current hash.
+
+    A spot-check's `qa:` receipt does not raise the nodes it found in error (spec/08 §8.2).
+    """
     level = {n["id"]: n.get("fidelity") for n in nodes if "fidelity" in n}
     for rec in records:
         if rec["format"] != "scienting-receipt/1":
             continue
-        if receipt_status(rec, records, roster, owners) != "valid":
+        if receipt_status(rec, records, roster) != "valid":
             continue
+        wrong = {e["node"] for e in (rec.get("qa") or {}).get("errors", [])}
         for nid, h in rec.get("nodes", []):
-            if nid in level and values[nid]["node_hash"] == h:
+            if nid in level and nid not in wrong and values[nid]["node_hash"] == h:
                 if LEVELS.index(rec["level"]) > LEVELS.index(level[nid]):
                     level[nid] = rec["level"]
     return level