test(runtime): add sourceos-shell service graph contract check

[mdheller]

Summary

Stacked on top of the current sourceos-shell Linux realization chain, this PR adds a dedicated service-graph contract check and wires it into the flake checks so the shell target grouping is validated explicitly.

Added files

• tests/sourceos-shell-service-graph-contract.nix

Updated files

• flake.nix
• docs/sourceos-shell-service-graph.md

What it does

• adds a new contract-style check for the shell service graph
• verifies that sourceos-shell.target exists
• verifies that the current four runtime scaffolds are grouped beneath the target:
  • sourceos-shell
  • sourceos-router
  • sourceos-pdf-secure
  • sourceos-docd
• wires the check into flake.nix
• updates the service-graph documentation to mention the check explicitly

Why

The previous PR introduced the target scaffold and the partOf relationships. This follow-on PR makes that grouping enforceable in the repo's check surface rather than leaving it only as implementation convention.

Stack relationship

This PR is stacked on top of:

• source-os#26
• source-os#70
• source-os#71
• source-os#72
• source-os#73

Follow-on

• replace placeholder runtime paths once SourceOS-Linux/sourceos-shell exists
• turn scaffold checks into executable service/runtime checks when the real runtime repo lands