Define the CLI distribution contract

[konojunya]

Summary

• define the planned tier-1 target matrix for macOS and glibc Linux without claiming an available release
• specify immutable artifact names, reproducible archive contents, version policy, checksums, Sigstore bundles, SBOMs, provenance, and rollback
• separate GitHub Releases, Homebrew, Cargo, Aqua, and self-update ownership, including safe refusal outside direct-install receipts
• publish a machine-readable contract and schema with CI validation and negative tests
• keep the occupied stack-cli crates.io name unset as a public package name until a distinct registry identity is verified

Validation

• node scripts/validate-distribution-contract.mjs
• node --test scripts/distribution-contract.test.mjs
• JSON Schema validation with Ajv 2020
• cargo fmt --check
• cargo test --locked
• formatter and template conformance tests against the pinned specification
• cargo clippy --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --locked
• cargo build --release --locked
• Rust 1.85 tests and Clippy
• coverage: 91.68% lines, 95.86% functions, 91.66% regions

No binary or package-manager release is published by this change.