Define Program Intake contract and queue ownership

[yvette-carlisle]

Summary

• Add decodex.program_intake_plan/1 metadata alongside internal Execution Programs.
• Define program node lifecycle/readback states and queue-label ownership evidence.
• Make program-owned queue-label removal fail closed and surface expanded operator counts.
• Update runtime/tracker/operator docs for first-class Program Intake contract boundaries.

Recovery context

Manual takeover for Linear XY-937 retained partial progress from .worktrees/XY-937 after Decodex stopped at retained attention. The patch was migrated onto current main before review and validation.

Verification

• cargo make fmt
• cargo make lint-fix
• cargo make test
• semantic drift check: searched changed runtime/docs surfaces for stale paused_count/program-intake/readback naming

[yvette-carlisle]

Superseded by #334, which uses the original retained Decodex runtime branch y/decodex-xy-937 so review-handoff recovery can bind the PR to XY-937.