Catalog contract v1.0.0

Public catalog types and pure identity, grouping, filtering, recommendation and coverage behavior. No source evidence, credentials, private database or model clients. Producer installs the versioned tarball with lockfile integrity.