[P0][CORE-01] Versioned domain and IPC contracts

Parent: #1

## Objective
Define the stable Rust contracts that every trusted process, worker, connector, model host, UI renderer and external-agent adapter uses. This is the foundation for replacing chat-centric state with durable product state.

## Scope
- Define typed IDs and versioned schemas for `GoalContract`, `Workspace`, `Task`, `Capability`, `Observation`, `Evidence`, `ActionProposal`, `Approval`, `Operation`, `Receipt`, `ViewDefinition`, `MemoryRecord` and artifact references.
- Define explicit request/response/event envelopes with request IDs, deadlines, cancellation IDs, trace IDs and schema version.
- Authenticate local IPC peers and bind process identity/role to allowed message families.
- Enforce message size, collection size, recursion/depth and backpressure limits.
- Support version negotiation plus forward/backward-compatible migrations where explicitly declared.
- Keep raw browser/OS/provider handles out of general contracts; use broker-resolved typed IDs.

## Architecture requirements
- Rust + Serde first; schemas must be serializable for golden fixtures and protocol recordings.
- OS-local IPC preferred over publicly reachable localhost services.
- Unknown fields/versions must have defined handling rather than accidental permissiveness.
- Contracts must not encode a model provider as the durable owner of task/workspace state.

## Acceptance criteria
- [ ] All core records have schema versions and migration tests.
- [ ] Malformed, oversized and unsupported-version messages are rejected safely.
- [ ] Negotiated compatible versions round-trip without semantic loss.
- [ ] Cancellation and deadlines propagate across at least two worker boundaries.
- [ ] IPC peer authentication prevents an untrusted local process from impersonating a privileged broker.
- [ ] Golden contract fixtures run in CI.

## Tests
Property tests for parsing/serialization; fuzz malformed envelopes; migration round-trips; replay recorded older-version fixtures; authentication-negative tests.

## Dependencies
None. This issue is intentionally first.

**First phase:** P0
**Maturity target:** P1
**Workstream:** Runtime and contracts

No repository files or entry points are named. Start by locating the Rust contract and IPC boundaries, then review the acceptance criteria and listed property, fuzz, migration, replay, and authentication-negative tests. Done means versioned contracts, safe rejection, compatible negotiation, propagation across workers, authenticated peers, and golden fixtures in CI.

Written by the indexing model from the issue text.