kdd-scaffold: generate KDD task contracts as a native Tool

[MauricioPerera]

Repo: https://github.com/MauricioPerera/kdd-scaffold

Fourth plugin in this batch. Complements kdd-gates (#4797): that one validates KDD task contracts, this one generates them. kdd_scaffold writes knowledge/contracts/<task>.md (frontmatter + all 7 required sections) from an oracle test file that must already exist — oracle-first is enforced, not just suggested.

Two things that might be useful to anyone building a Tool that mutates files or handles frozen hashes:

• Use ctx.fs, not raw node:fs. A plugin's host code can reach around the harness's own filesystem seam with zero friction — nothing stops you. But ctx.fs.resolve/stat/readText/writeText plus ctx.waterfall('fs/write-intent', ...) and ctx.emit('fs/observed', ...) is what keeps a write inside the same sandbox/observed-state pipeline the agent's own edit tool uses (mirrored dsh-tool-str-replace-editor's own implementation to get this right).
• Never trust a caller-supplied hash for something meant to be frozen. tests_sha256 is computed here directly from the oracle file's real content (SHA256, LF-normalized) — the same algorithm validate_contracts.py --hash uses — instead of accepting it as a tool parameter.

Real bug found while verifying it live: an empty tags: [] passes validate_contracts.py cleanly but fails validate_okf.py (also scans knowledge/contracts/), which requires a non-empty, lowercase tags list. Made tags a required parameter instead of a silent empty default.

Verified end-to-end against the real KDD template repo: scaffold → validate, 0 errors on both gates on the first clean run.

MIT licensed, tagged dsh-plugin.