feat: validator, bundle builder and release checks for 0.1.0

- Add tools/validate.py: validates packages, and with --correction runs
  proposed corrections through the gate against a package without
  writing anything (spec/11 §11.4). The gate now refuses a proposal that
  fails the correction schema, rule correction.schema.
- tools/load.py validates every package before loading, and with
  --bundle --built-from builds a scienting-bundle/1 with the FTS5 search
  index and bundle_meta (spec/13 §13.5). Search rows are defined per
  unit (sentence, cell, equation outside a sentence, figure-text) with
  the parent kind as context.
- Roster keys carry a role, and a key with the role owner may revoke any
  receipt (spec/08 §8.7, spec/20); roster schema, store table and the
  fixture roster updated. The checker signs a trial revocation to prove
  the rule both ways.
- A qa: receipt raises the nodes it sampled except those in its errors
  (spec/08 §8.2); the example paper's fidelity counts become 27 F3,
  13 F2, 4 F1 and 1 F0.
- The destination chooses the keyed scheme, not the text policy:
  hmac-team between the team's machines, hkdf-pages outside the team
  (spec/05 §5.8, spec/12 §12.5).
- A TextQuoteSelector must repeat the anchor's plain quote and is absent
  for hashed or keyed anchors (spec/18 §18.3).
- Add fixtures/records/suspect.json, a scienting-suspect/1 record.
- Oracle: hashes are kept incrementally and checked after every
  correction against a full recomputation; load and write refuse unsafe
  manifest paths; Ed25519, HKDF and schema validation come from the
  cryptography and jsonschema packages; canonical JSON uses the built-in
  encoder with an exact RFC 8785 fallback.
- The tools need Python 3.14 with cryptography and jsonschema; the py310
  CI environment is dropped and the workflow runs the default only.
- Resolve every [CHECK] note in the docs, READMEs and context; add
  CONTRIBUTING.md; every tool answers --help and refuses unknown options.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tools/validate.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Validate packages, or run the correction gate on proposals against a package.
+
+Non-normative tooling.
+Usage: python3 tools/validate.py PACKAGE [PACKAGE ...]
+       python3 tools/validate.py --correction PROPOSALS PACKAGE
+A package is checked as spec/22 §22.2 describes, and each failure printed as `package: where: rule: message`.
+With --correction, PROPOSALS is a JSON file holding one proposed correction, or a JSON Lines file of several
+applied in order. Each runs through the gate (spec/11 §11.4) against the package's current state, and the record
+it would append to corrections.jsonl is printed, until one is refused. Nothing is written.
+Exit status: 0 when everything is valid, 1 when something is refused, 2 for a usage error.
+"""
+
+import argparse
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, ROOT)
+
+from tools.oracle import corrections, jcs, package  # noqa: E402
+from tools.oracle.schema import Store  # noqa: E402
+from tools.oracle.tree import Refusal  # noqa: E402
+
+
+def read_proposals(path):
+    with open(path, encoding="utf-8") as f:
+        text = f.read()
+    try:
+        return [json.loads(text)]
+    except json.JSONDecodeError:
+        return [json.loads(ln) for ln in text.splitlines() if ln.strip()]
+
+
+def main():
+    lines = __doc__.splitlines()
+    ap = argparse.ArgumentParser(description=lines[0], epilog="\n".join(lines[5:]),
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--correction", metavar="PROPOSALS",
+                    help="a JSON or JSON Lines file of proposed corrections to run through the gate")
+    ap.add_argument("packages", nargs="+", metavar="PACKAGE", help="package folders")
+    a = ap.parse_args()
+    if a.correction and len(a.packages) != 1:
+        ap.error("--correction checks proposals against exactly one package")
+    store, bad = Store(os.path.join(ROOT, "schemas")), False
+    for p in a.packages:
+        for e in package.validate(p, store).errors:
+            print("%s: %s: %s: %s" % (p, e["where"], e["rule"], e["message"]), file=sys.stderr)
+            bad = True
+    if bad:
+        return 1
+    if not a.correction:
+        for p in a.packages:
+            print("%s: valid" % p)
+        return 0
+    pkg = a.packages[0]
+    state = package.read_state(pkg)
+    if any(n.get("withheld") for n in state.nodes):
+        print("%s: doc.policy.withheld: a package that withholds its text takes no corrections" % pkg,
+              file=sys.stderr)
+        return 1
+    for i, proposal in enumerate(read_proposals(a.correction), 1):
+        try:
+            state, record = corrections.gate(state, proposal, store)
+        except Refusal as e:
+            where = "%s:%d" % (a.correction, i) + (" " + e.node if e.node else "")
+            print("%s: %s: %s" % (where, e.rule, e.message), file=sys.stderr)
+            return 1
+        print(jcs.dumps(record))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())