v0.2.3: contract-change fence

Contract-change fence

A Plan Lattice lease is now bound to the complete project contract that was last rendered to the model. Immediately before each configured guarded write enters its side-effect pipeline, v0.2.3 recomputes the bounded contract digest. If a declared document changed, disappeared, became unsafe, or exceeded the configured budget, the write is denied until lattice_refresh_context renders the current contract again.

The real Harness ToolRuntime proof covers a requirement change after checkout and another after a checkpoint: both deny the next write, then permit it only after the new document body is rendered. The suite also retains the real compaction lifecycle, child reconciliation, and valid 100,000-node restart/status coverage.

This detects contract state at authorization time; it does not replace a host filesystem lock for an arbitrary concurrent third-party writer. Validation: 11 tests, strict TypeScript, build, publint, exact-diff secret scan, packed-profile boot, and loopback HTTP 200.