Implement RuntimeInstallReceipt emission for runtime install/update flows

[Copilot]

Closes the runtime-install observability gap: agent-machine had no structured receipt type for runtime installation lifecycle transitions. This adds RuntimeInstallReceipt emission covering all 10 install states with artifact verification, policy decision linkage, rollback tracking, and compact log references.

Schema

• contracts/runtime-install-receipt.schema.json — copied verbatim from SourceOS-Linux/sourceos-spec (commit 5e3ba19d); no local fork, no drift risk
• src/agent_machine/contracts.py — registers RuntimeInstallReceipt in schema_by_kind(); extends validate_by_kind() to accept type as fallback to kind (upstream spec uses type, local schemas use kind)

Emission module

src/agent_machine/runtime_install_receipt.py:

receipt = build_receipt(
    receipt_id="urn:srcos:receipt:runtime-install:...",
    install_state="installed",       # or: failed, rolled_back, partial, denied, deferred, …
    failure_reason=None,             # required for failed/partial/denied/deferred
    rollback_ref=None,               # required when rolled_back
    log_mode="compact_receipt_ref",  # default; full manifests go to evidence bundles
    evidence_refs=["urn:srcos:evidence:..."],
    ...
)
validate_receipt(receipt)            # schema + cross-field semantics
log.info(emit_compact_log(receipt))  # single-line: id, state, evidence[0]

Semantic invariants enforced beyond JSON Schema:

• failed | partial | denied | deferred → failureReason required
• rolled_back → rollbackRef required
• installed → failureReason must be absent
• evidenceRefs must be non-empty

Examples

Six canonical fixtures in examples/runtime-install-receipt.*.json:

File	installState	Scenario
installed	installed	Success path
failed	failed	Artifact digest verification failure
denied	denied	Policy-denied install
partial	partial	Core installed, extension artifact failed
rolled_back	rolled_back	Post-install health check failed, rollback executed
deferred	deferred	Install window not open

Validation

• scripts/validate-runtime-install-receipts.py — validates all six examples, compact log output, and semantic rejection cases
• Makefile — validate-runtime-install-receipts added to top-level validate target