fix(types): close production admission and authoring contracts - #39

What

• Add the strict authoring command parser and its generated schema.
• Add one signed Production admission registry with active and revoked entries.
• Allow null admission expiry until revocation. Enforce any supplied expiry.
• Parse each admission from the exact referenced qualification-release/v2 bytes and check the target, repository, claim, artifacts, digests, and authority mapping.
• Require the caller's trusted minimum registry revision so an older active registry can't replace a newer revocation.

The contract adds no permit, lease, execution-authority file, or revocation-history object.

Release boundary

This branch is one patch-classified commit after v0.17.0. Semantic Release selects 0.17.1 and owns the version, changelog, and lock changes. The release job scans the exact wheel and sdist that it publishes. It doesn't rebuild them between the boundary check and upload.

Verification

• 471 tests passed.
• Schema exports are reproducible.
• Ruff lint passed.
• Release lock passed.
• Wheel and sdist source-boundary scans passed.
• A temporary release simulation selected and built 0.17.1 twice with identical hashes.
• Independent review found no P0, P1, or P2 issue.