fix(contracts): sync calculated product trustScore and cumulative votesCount

The web workspace change unifies product Trust Passport scores. Published catalog JSON trustScore now contains the calculated score instead of the legacy cumulative vote counter, and adds votesCount for that counter. Released to production through https://github.com/mrgoonie/nextlevelbuilder-web/pull/26 (merge 0953b2b73de8f2b627e03cf577db68fa6733baee). Production deployment succeeded: https://github.com/mrgoonie/nextlevelbuilder-web/actions/runs/34683154108. Live verification confirms list/detail/UI/Markdown agree: AgentKit trustScore 60, votesCount 0.

Web evidence: lib/domain/trust.ts (projectProductTrust, getProductTrustFactors), lib/domain/catalog.ts (list/detail projections and trust ordering before pagination), and lib/openapi.ts (Product schema). List/detail JSON, Markdown exports, and llms.txt use the same score.

Formula: published +40; HTTPS URL +20; +2 per vote capped at 20; +2 per full seven days since creation capped at 10. Verified traction remains disabled, so the current maximum is 90 on a 0–100 scale. Payment/editorial flags do not contribute. Voting rules and time-window leaderboards are unchanged. The database legacy counter remains unchanged; historical synthetic seed values are not repaired by this code change.

Required toolkit follow-up:

• Add and document votesCount in packages/contracts/src/document.ts ProductSummarySchema (currently only trustScore is declared near line 413). Support servers that omit it during rollout.
• Keep CLI and MCP displaying server-calculated trustScore; never recompute from it as if it were a vote count. Check CLI list/get (packages/cli/src/commands/list.ts, get.ts) and MCP product tools.
• Add contract/client regression cases: published HTTPS product, age 14 days, five votes => trustScore: 74, votesCount: 5; high vote totals remain bounded; missing votesCount remains compatible.

Validation in the web workspace: type-check passed; 35 Vitest files / 314 tests passed, including shared-score and successful/failed UI voting regressions. Scope is toolkit synchronization with the released web change.

Start with packages/contracts/src/document.ts, where ProductSummarySchema currently declares trustScore, then inspect packages/cli/src/commands/list.ts, get.ts, and the MCP product tools to trace server-provided values. Add the votesCount contract and compatibility for omitted values, preserve the server-calculated trustScore, and cover the specified score, cap, and missing-field cases with regression tests.