Add user-imported provider pack contract

[konojunya]

Summary

• add a separate local-only provider icon pack schema and contract
• expose equivalent Rust and TypeScript types plus packaged schema artifacts
• validate namespaces, hashes, transformations, local paths, and SVG safety
• keep AWS, Google Cloud, Azure, and all other vendor asset bytes out of the repository and packages
• bump the pre-1.0 catalog and package version to 0.3.0

Rights boundary

Provider packs require an explicit user-selected local archive and terms acceptance. Package redistribution, automatic download, and server upload are fixed to false. The repository contains only an Apache-2.0 contract and a fictional fixture.

Validation

• npm run validate
• npm run generate:check
• npm test
• npm run typecheck
• npm pack --workspace @stack-sh/theme --dry-run
• cargo fmt --all --check
• cargo test --workspace --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo doc --workspace --no-deps --locked
• Rust 1.85 tests and clippy
• cargo package -p stack-theme --locked --allow-dirty