feat(reconciliation): compare approved and observed state

[ElliotSun]

Summary

Add the first platform-neutral reconciliation engine for M1 Production Contract Assurance.

Approved ODCS desired state
          +
ObservedPlatformState
          ↓
ReconciliationResult
          ↓
raw deterministic differences[]

This PR answers what differs. It does not classify drift cause or operational status; #14 owns that layer.

Identity boundary

Approved-state matching reuses the frozen M0 canonical identity implementation:

schema identity   = normalize(schema.name)
property identity = (schema identity, normalize(property.name))

Observed assets/properties are projected onto those same governed keys using asset/property names. Platform namespace remains observation context and does not redefine governed identity. Duplicate canonical observed identities fail closed.

v1 comparison scope

Only semantics currently represented on both sides are compared:

• asset/schema presence;
• property presence;
• ODCS physicalType vs observed physical_type using trim + case-insensitive textual comparison;
• explicit ODCS required vs observed nullable when both are boolean values.

Unknown/unasserted values are not guessed.

Raw difference model

ReconciliationDifference uses generic typed dimensions (missing / unexpected / mismatch plus subject/path/expected/observed). These are intentionally not the stable automation reason codes; #15 maps raw differences onto the public reason-code taxonomy.

ReconciliationResult carries:

• contract id/version;
• observation source identifier;
• observation fingerprint;
• deterministic differences.

Determinism / safety

• approved indexes reuse M0 identity validation;
• observed duplicate identities fail closed;
• difference ordering is explicit and independent of input ordering;
• serialization is stable JSON;
• neither input is mutated;
• no governance decision, lifecycle transition, drift status, cause attribution, or runtime mutation occurs here.

Out of scope

• logical type (not yet observed);
• provider asset-type equivalence;
• governed metadata/comments/tags/owners;
• constraints/relationships/lineage;
• stable public reason codes (feat: Export-level Graph Validation and Sovereignty Interception #15);
• IN_SYNC/drift/pending-deployment/external-edit classification (feat: implement tensor friendly json and cypher graph serializers #14);
• deployment/release history or remediation.