Add guarded OOXML Office artifact generation

[mdheller]

Summary

Adds dependency-light, guarded OOXML generation for SourceOS Office Plane artifacts.

This extends the existing sourceosctl office generate --execute --policy-ok path from safe text/Markdown/JSON generation to minimal DOCX/XLSX/PPTX package generation using only Python standard library ZIP/XML helpers.

Changes

• Adds sourceosctl/commands/ooxml.py with minimal DOCX/XLSX/PPTX builders.
• Enables guarded generation for:
  • docx
  • xlsx
  • pptx
• Keeps unsupported binary formats such as odt, ods, and odp blocked for generation until LibreOffice/Collabora/ONLYOFFICE template backends are hardened.
• Emits OfficeArtifactEvidence for generated OOXML artifacts.
• Adds tests that inspect generated ZIP package members for DOCX/XLSX/PPTX and verify evidence hashes.
• Updates README command docs and boundary language.

Safety posture

• Dry-run remains default.
• --execute still requires --policy-ok.
• Output root policy checks remain enforced.
• Generated artifacts remain requires-review in evidence.
• This is not a full template engine, editor, or collaboration backend.
• Email sending, external publishing, and calendar mutation remain disabled.

Validation

Expected repo validation:

make validate