Harden sourceos-ai CLI contract: top-level list/validate, repo maturity record

[Copilot]

sourceos-model-carry lacked a maturity record and the sourceos-ai CLI was missing ergonomic top-level list and validate commands required by the installable CLI contract.

Changes

• cmd/sourceos-ai/main.go — Added top-level list and validate commands as direct aliases for carry list / carry validate, completing the five-command CLI contract (--version, doctor, list, validate, emit-evidence)

• docs/SOURCEOS_AI_CLI.md — Updated command contract table to include top-level list and validate with alias note; gives a future Homebrew/Prophet implementer the full surface without guessing

• repo.maturity.yaml (new) — repo-maturity.v1 record documenting maturity level M2→M3, the explicit carry boundary (sourceosRefuses / sourceosCarries), upstream integrations, and next actions

• Makefile — make validate now exercises both carry validate and the new top-level validate + list paths, proving the full contract end-to-end

• .gitignore — Excludes bin/, dist/, tmp/ build artifacts

$ make validate
OK: validated 6 SourceOS carry references   # python validator
# carry validate, validate, list, doctor, self-test, emit-evidence → all ok