feat(reborn): wire built-in obligations and handoffs

[serrrfirat]

Summary

Draft/snapshot carve-out for PR6 from the existing Reborn obligations branch material.

This branch contains the PR6 contract surface for built-in V1 obligations and runtime handoffs:

• all unsupported/unconfigured V1 obligations fail closed;
• metadata-only audit obligations before/after dispatch;
• network policy storage/runtime handoff;
• secret lease/injection handoff;
• prepared mount handoff with subset checks;
• prepared resource reservation handoff and abort cleanup;
• output limit enforcement before publication;
• output redaction before publication;
• pre-dispatch obligation propagation through dispatcher/runtime lanes.

Primary contract files in this snapshot include:

crates/ironclaw_host_runtime/tests/builtin_obligation_handler_contract.rs
crates/ironclaw_capabilities/tests/capability_obligation_handler_contract.rs
crates/ironclaw_dispatcher/tests/dispatch_contract.rs
crates/ironclaw_dispatcher/tests/event_dispatch_contract.rs
crates/ironclaw_dispatcher/tests/vertical_slice_contract.rs
crates/ironclaw_resources/tests/resource_governor_contract.rs
docs/reborn/contracts/capabilities.md
docs/reborn/contracts/dispatcher.md
docs/reborn/contracts/host-api.md
docs/reborn/contracts/host-runtime.md
docs/reborn/contracts/resources.md

Draft / dependency note

This PR is intentionally opened as a draft snapshot so the contracts are visible on a PR now.

It is not yet a clean merge candidate because the source branch is an older integrated Reborn stack snapshot. The PR6 branch needs to be retargeted/narrowed after the prerequisite branches land/rebase, especially:

• feat(reborn): add wasm runtime lane #3028 WASM runtime lane;
• feat(reborn): add capability host base #3071 CapabilityHost base;
• feat(reborn): add secrets and network boundaries #3077 secrets/network boundaries;
• PR4f host-runtime composition work.

Until then, this PR should be treated as contract/reference material, not a ready-to-merge diff.

Verification

Not rerun after opening this snapshot PR. The source material is present from the existing Reborn obligations branch; it will need a fresh rebase/narrowing pass and targeted verification before merge readiness.

Refs #2987.

[gemini-code-assist]

Code Review

This pull request introduces a modular architecture for the IronClaw Reborn system by defining clear boundaries between service crates and implementing contract tests to enforce these dependencies. It adds several new crates (ironclaw_approvals, ironclaw_authorization, ironclaw_capabilities, ironclaw_dispatcher, ironclaw_events, ironclaw_extensions, ironclaw_filesystem, ironclaw_host_api, ironclaw_host_runtime) and updates the workspace configuration. My feedback highlights that the architectural boundary test in crates/ironclaw_dispatcher/tests/boundary_contract.rs is currently fragile due to string-based parsing of Cargo.toml and should be refactored to use cargo_metadata for more robust dependency inspection, following the pattern established in ironclaw_architecture.

[gemini-code-assist]

The test dispatcher_crate_does_not_depend_on_higher_level_workflow_crates uses a simple string check on the Cargo.toml file content to enforce architectural boundaries. This is fragile and prone to false negatives. Consider using cargo_metadata to programmatically inspect the dependency graph, similar to how crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs does it. If you do, ensure that the setup (e.g., fetching metadata) uses expect() to fail the test with a clear message if environmental requirements are not met, avoiding silent fallbacks like unwrap_or().

References

1. In tests, when setting up a state that depends on environmental factors, prefer expect() to explicitly fail the test with a clear message if the setup is not possible. Avoid fallbacks like unwrap_or() that could cause the test to silently check the wrong logic.