okf: align with upstream OKF v0.2 — vault→bundle vocabulary migration + conformance audit (ADR-009)

Implements the accepted ADR-009 (okf/docs/decisions/ADR-009-okf-v02-alignment.md), deliberately kept out of the ADR-001–008 PR stack because it touches on-disk contract.

Two parts, one deliberate pass:

1. Vocabulary migration (okf only) — finish what ADR-008 started: the API class is now Bundle, but okf-vault.json (marker), CLI strings ("not a vault"), <vault-dir> argument names, local identifiers (withVault, vaultDir, VAULT_* error codes), GLOSSARY entries, and SPEC prose still say vault. Inventory each surface, decide migrate/keep item-by-item. The marker rename must move in lockstep with ADR-006's wrong-tool guardrail and needs a back-compat open path for existing on-disk stores. vault-ld keeps its vocabulary throughout.

2. v0.2 conformance audit — upstream (pinned by okf/OKF.SPEC.v2.md, checked 2026-08-01) made breaking changes affecting what we emit/ingest: timestamp → generated: { by, at }; body # Citations → frontmatter sources; plus the new actor convention, status/stale_after lifecycle fields, and credibility signals. Audit emission + ingest against v0.2 §-by-§; every divergence either gets fixed or lands in DEVIATIONS.md with rationale — no silent drift.

Acceptance criteria are in the ADR. Blocked-by: the ADR-001–008 stack landing (starts at #54), so the migration sweeps final code.

Start with okf/docs/decisions/ADR-009-okf-v02-alignment.md, then inventory the okf-vault.json marker, CLI strings, argument names, identifiers, GLOSSARY, and SPEC prose. Audit emission and ingest against okf/OKF.SPEC.v2.md section by section, including generated, sources, lifecycle, and credibility fields. Done means the marker has a back-compatible open path and every divergence is fixed or recorded in DEVIATIONS.md.