reliability endpoint instead of the customer's `track()` pipeline.
Independent-controller flow per Privacy Policy §6; schema-locked by
`contracts/diagnostics/contract-failed-payload-schema-lock.json`.
`ContractFailureInput.extra` removed (schema-lock forbids unbounded
fields); `ContractFailureInput.deviceClass` added.

**Runtime contract verifier layer.** The SDK now self-tests its
own structural contracts at runtime — per-user cache isolation,
idempotency-key determinism, error-envelope shape, flush-interval
parity, super-property merge precedence. Verifiers run on every
relevant SDK operation; PASS results stream to the developer's
console when `logVerifierResults: true`; FAIL results fire
`reportContractFailure(...)` to the reliability channel.

Three new `CrossdeckOptions` flags:
  - `verifyContractsAtBoot` — default dev=true, prod=false
  - `logVerifierResults` — default dev=true, prod=false (cosmetic only)
  - `disableContractAssertions` — sovereignty kill-switch, default false

Bundle-size budget bumped 45 → 55 KB gzipped (core) and 26 → 32 KB
(UMD) to accommodate the ~6 KB verifier framework + verifier
implementations. The platform-hardening signal — every install
in the field tests its own structural contracts as it operates and
reports failures to Crossdeck's reliability workspace in real time —
is the trade-off.