docs: add CommandLayer stack contract for cross-repo alignment

[GsCommand]

Motivation

• Provide a canonical, RFC-style cross-repository contract that binds how CommandLayer repos interpret and enforce the receipt lifecycle.
• Establish normative protocol-level expectations (fields, canonicalization, hashing, signatures, verification checks, and error codes) without replacing CLAS schemas or governance RFCs.
• Prevent ad-hoc divergence by defining repository responsibilities and rules for changing the contract.

Description

• Added the contract document at contracts/commandlayer-stack-contract.md on branch align/clas-stack-contract that defines authority/scope, repository responsibility mapping, receipt object requirements, canonicalization, hashing, signatures, verifier shape, verification checks, standard error codes, compatibility expectations, change rules, and non-goals.
• Receipt requirements include required top-level fields (receipt_id, signer, verb, ts, input, output, execution, metadata) and metadata.proof fields (canonicalization, hash.alg, hash.value, signature.alg, signature.value, signature.kid).
• Normative cryptographic and processing defaults are specified as: canonicalization ID json.sorted_keys.v1, hash algorithm SHA-256 (lowercase hex encoding by default), and signature algorithm Ed25519, and the document mandates deterministic verification behavior and explicit failure modes.
• The contract defines a minimum verifier response shape for verified and invalid receipts, required verification checks, a set of standard error codes, per-repository MUST/SHOULD/MUST NOT constraints, and explicit non-goals; no schemas or package exports were modified.

Testing

• The file was committed on branch align/clas-stack-contract with commit a1143a4ee6d1123d9dd6665fb659a49475ad4b46 via git commit; the new file content was inspected with nl -ba contracts/commandlayer-stack-contract.md and matches the expected contract text.
• Attempted to push with git push -u origin align/clas-stack-contract failed because no origin remote is configured in this environment, so no remote PR was created.
• No automated unit or schema tests were run as this change is a documentation-only, contract-file addition.

---

Codex Task