[codex] add contracts foundation

[FlowmemoryAI]

Summary

Adds the first FlowMemory contracts foundation: a small commitment-oriented FlowPulse event schema, a minimal RootfieldRegistry, schema documentation, and Foundry tests.

This is intentionally a foundation PR, not a production protocol launch.

What Changed

• Added contracts/FlowPulse.sol with the canonical FlowPulse event interface and initial pulse type constants.
• Added contracts/RootfieldRegistry.sol for registering Rootfield namespaces and submitting committed roots.
• Added contracts/FLOWPULSE_SCHEMA.md documenting the v0 event fields and receipt boundary.
• Added tests/RootfieldRegistry.t.sol with Foundry tests for registration, pulse emission, root submission, duplicate/zero-id rejection, and owner-only root submission.
• Added tests/README.md with the current test command.
• Updated docs/SECURITY_MODEL.md with the contracts-foundation assumptions, especially that URI fields are advisory log data and do not enforce the off-chain-data boundary.

Why

FlowMemory needs a small, reviewable protocol starting point before indexers, verifiers, dashboards, hardware, or future appchain work depend on any event or root semantics.

The main boundary preserved here: contracts emit roots, commitments, counters, actors, timestamps, and advisory URI strings. They do not know receipt-only metadata such as txHash or logIndex; indexers derive those after reading receipts and logs.

Validation

• git diff --check
• forge test --root . --contracts . --match-path tests/RootfieldRegistry.t.sol --out E:\tmp\flowmemory-forge-out --cache-path E:\tmp\flowmemory-forge-cache -vv

Result: 6 tests passed, 0 failed.

Risks And Assumptions

• This PR does not implement a Uniswap v4 hook yet.
• This PR does not implement indexers, verifiers, workers, apps, hardware, cryptographic proof systems, tokenomics, or L1/appchain logic.
• metadataURI and evidenceURI are arbitrary emitted strings. They are not length-limited, format-checked, resolvability-checked, or privacy-preserving by contract logic.
• Heavy or sensitive data must stay off-chain by policy and verifier design; this skeleton does not enforce that boundary by itself.

Merge Notes

Keep this PR as draft until the bootstrap repository scaffolding PR is merged or this branch is rebased on the final bootstrap docs.

Depends on #1.