feat: add immutable deployment bundle contract

[Pigbibi]

Summary

• add the strict, dependency-free DeploymentBundle v1 schema and validator
• bind strategy source revision to the declared strategy dependency before digest verification
• reject impossible RFC3339 UTC calendar timestamps and preserve fail-closed synthetic coverage

Validation

• PYTHONPATH=python python3 -m pytest -q python/tests/test_deployment_bundle_contract.py
• python3 -m unittest discover -s python/tests -v
• runtime/config, schema, compile, package, actionlint, Node, matrix, scope, and secret gates

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 768457d4ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce calendar-valid timestamps in the shared schema

When a downstream consumer validates bundles using this shared Draft 2020-12 schema alone, format is annotation-only unless the validator explicitly enables format assertions, and the regex accepts impossible dates such as 2026-13-01T00:00:00Z. Such a bundle therefore passes the schema but fails _expect_timestamp, creating inconsistent contract behavior across consumers; require format assertion in the documented validation path or otherwise enforce calendar validity for schema consumers.

Useful? React with 👍 / 👎.