Support versioned semantic profile packages and pinned vocabulary artifacts

Tracked by #590. Depends on the 1.0 concept contract in #589.

## Outcome

A Registry project can select one or more authoritative semantic profiles, pin their vocabulary artifacts and mappings to exact reviewed versions and digests, and validate Manifest concepts without mutable runtime network access.

PublicSchema is one possible authority. EU SEMIC, FHIR, SDMX, national vocabularies, and local extensions are equally supportable through the same contract.

## Requirements

- Define a versioned semantic-profile artifact or an additive extension of `registry-manifest-profile/v1`.
- Represent profile identity, version, review state, vocabulary namespaces, artifact provenance, content digests, licenses, and supported concept mappings.
- Give mappings explicit relations such as exact, close, broader, or narrower. Multiple concept references must not imply equivalence.
- Resolve and validate profile packages locally from release-pinned or project-pinned inputs. No Relay startup-time HTTP vocabulary lookup.
- Validate that referenced concepts exist in the pinned artifacts where the artifact format supports deterministic checking.
- Support local extensions without allowing them to redefine protected external namespaces.
- Make profile selection and effective versions visible through deterministic explanation output.
- Preserve all existing `vocabularies`, `profiles`, and `concepts` behavior.

## Acceptance criteria

- [ ] A documented profile package pins at least one PublicSchema artifact and one EU SEMIC artifact by version and SHA-256 digest.
- [ ] A valid Manifest can select either profile independently or use both.
- [ ] Unknown terms, namespace conflicts, digest mismatches, and unsupported mapping relations produce field-addressed diagnostics.
- [ ] Validation works offline from the pinned package.
- [ ] Repeated compilation of the same inputs produces identical effective profile output.
- [ ] Existing beta manifests compile unchanged without a semantic profile package.
- [ ] Profile schema, CLI reference, fixtures, and generated documentation are updated together.

## Non-goals

- Privacy classification fields
- Runtime authorization or redaction
- Automatic concept selection
- Declaring PublicSchema as a globally hardcoded default
- Treating PublicSchema's partial external views as authoritative copies of external standards

Beginne mit dem Lesen des 1.0-Konzeptvertrags in #589 und des Tracking-Issues #590 und untersuche anschließend das Verhalten der vorhandenen Vokabulare, Profile und Konzepte. Verwende das Profilschema, die CLI-Referenz, Fixtures und die generierte Dokumentation als Integrationspunkte; fertig bedeutet, dass festgelegte PublicSchema- und EU-SEMIC-Pakete offline mit deterministischen Diagnosen validiert werden und das Verhalten von beta-manifest unverändert bleibt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.