Governed staged pre-load + atomic swap under a resource governor

[mdheller]

From the SourceOS-vs-Apple ModelCarry analysis (spec-intake 2026-08-03), section 5.2 medium-term. Apple pre-stages the next model set under a rolling disk-write governor (2 GiB / 24h reference pattern) and cuts over atomically. Our deployment path lacks the staged-then-swap pattern and the disk/CPU quota that keeps staging from starving live inference.

Builds on the content-addressed manifest (PR #20 / contracts/model-carry-manifest.schema.json).

Acceptance criteria

• A staging contract (schema + validator, following the manifest house style) describing: candidate manifest, pre-load target, resource governor bounds (max disk bytes over a rolling window, max concurrent extraction I/O), and an atomic cutover step.
• Cutover is atomic: live inference references either the old or the new manifest, never a partially-staged set.
• Verify-before-swap: every staged entry's content hash is checked against the candidate manifest before cutover; any mismatch aborts the swap (integrity failure is a hard stop).
• Governor bounds are enforced as an invariant with a negative fixture (staging that exceeds the disk/window budget is rejected).
• Wired into make validate; valid + negative fixtures.