docs(capabilities): define external provider contract

[627150795]

Problem\n\nOpenPI can compose external Skills, MCP servers, and Pi packages, but the repository did not yet define a reviewable boundary for their permissions, ownership, child safety, replay safety, credentials, or lifecycle evidence.\n\n## Value\n\nGive contributors and maintainers one explicit contract for integrating Browser, Web, GitHub, Computer, Security, and media providers without turning OpenPI into a second provider stack or silently widening child authority.\n\n## Approach\n\n- Add a design contract for provider identity, version, source, schema fingerprint, permissions, owner scope, safety classification, lifecycle, bounded results, credential ownership, and prompt-shape impact.\n- Define fail-closed intersection of parent authority, provider declaration, and child/Workflow policy, with Replay requiring an additional stable side-effect-free classification.\n- Define cancellation, cleanup, uncertainty, and result receipts and map the contract to existing OpenPI and Pi ownership seams.\n- Add a validation matrix and explicit non-goals so real provider work is only implemented when a concrete integration needs it.\n\n## Validation\n\n- git diff --check — passed\n- bun run lint — passed\n- bun run typecheck — passed\n- No runtime behavior was changed; this is a documentation/design-only PR.\n\n## Impact\n\n- User-visible behavior: None.\n- Model-visible context/tools: None.\n- Runtime/lifecycle: None.\n- Persisted config/data: None.\n- Compatibility/risk: Documentation only; it explicitly avoids adding a provider registry, external tool inheritance, or credential storage.\n\nFixes #169

[tt-a1i]

Thank you for preserving this research. We are closing this PR as a source record for the Capability, authority, and resources consolidation tracked in #277. This is not a finding that the content is wrong. The current queue contains overlapping contracts from one stale base, so we will extract only settled boundaries into at most one successor record, citing this PR explicitly. Please do not spend time rebasing this branch.