Add external service boundary recipe contract

[chubes4]

Summary

• Add generic inputs.externalServices recipe declarations for external service boundaries.
• Surface redacted boundary summaries in dry-run plans, run attestations, run metadata, failure diagnostics, and browser evidence host correlation.
• Document the product-neutral contract and add focused validation/dry-run/evidence serialization coverage.

Tests

• npm run build
• npx tsx tests/recipe-external-service-boundaries.test.ts
• npx tsx tests/recipe-secret-env.test.ts
• npx tsx tests/recipe-validation-descriptors.test.ts
• npx tsx tests/evidence-bundle-digest-and-recipe-artifact.test.ts

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Implemented the generic external service boundary contract, tests, docs, and verification.