[deploy-plugin DPB-5] Capability + topology contracts, rejection compiler, conformance harness

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Structural capability contracts (CapabilityRef namespaced+versioned, BindingRequirement, WorkloadConstraint, CapabilityVerdict with levels incl. unverified and scopes runtime/adapter/binding) + per-variant DeployCapabilityManifest (schemaVersion, toolVersions, probedAt); DeploymentCell/DeploymentTopologyPlan + suggested-cells.json; one pure compiler entrypoint over a versioned CapabilityCheckInput snapshot; the conformance-suite harness + in-memory fakes in ./testing. Anti-scope: core imports no leaf package; no live-provider claims (DP-2 §4/§5; SF-6/7/8, SG-4).

Acceptance

• gate: compiler rejects a required unsupported capability at build time with the manifest note
• gate: compiler emits suggestedCells and never partitions silently
• gate: parity test — identical verdict JSON for two consumers over one snapshot
• gate: lossless requires an evidence id (schema-enforced)

Metadata

Dependencies: DPB-1
Delivery shape: core contracts, backend-truthful