Consolidate the closed runtime recipe contract

## Outcome

Reduce drift between the release-lock producer, Rust verifier/renderer, Compose checker, fixtures, and runbook without turning Registryctl into a general orchestrator.

The existing 1.0 runtime recipe remains the behavioral baseline. This work should consolidate ownership after 1.0, not expand its command, mount, secret, or network vocabulary.

## Design constraints

- One versioned closed contract owns supported products, actions, mounts, inputs, platforms, health probes, and hardening.
- Relay, Notary, Registryctl, and release tooling retain their current ownership boundaries.
- No arbitrary container, command, mount, secret-provider, network, or Kubernetes language is introduced.
- Generated Compose remains replaceable and operator integration remains outside Registryctl certification.
- Security-sensitive parity checks stay fail-closed and reviewable.

## Definition of Done

- [ ] One authoritative versioned source produces or validates every runtime-recipe projection.
- [ ] Python and Rust no longer hand-maintain conflicting copies of fixed action shapes.
- [ ] Generated fixtures are reproducible and checked for drift.
- [ ] Platform pins, health ports, action inputs, network authority, mounts, and hardening have one parity gate.
- [ ] A compatibility policy describes how a future recipe version is introduced and retired.
- [ ] Clean-context Compose and released-artifact journeys remain green.

## Non-goals

- Production orchestration.
- Parent Compose certification.
- Kubernetes support, which remains tracked separately.
- User-defined runtime recipes.

Inizia mettendo in corrispondenza release-lock producer, Rust verifier/renderer, Compose checker, fixtures e runbook con il runtime recipe 1.0 esistente. Individua dove Python e Rust mantengono action shapes in conflitto, quindi traccia i percorsi di Compose in clean context e del released artifact. Il lavoro è completo quando una fonte versionata e un parity gate coprono le projections elencate, con fixtures riproducibili e una compatibility policy.

Scritto dal modello di indicizzazione a partire dal testo della issue.