Board: freeze provider-neutral observation contract

[jeffhuber]

Board needs one closed local read model for session and work activity before presentation or producer work can safely begin. This defines code_mower.boardObservation.v1, with exact session/work/run and repository/worktree binding, the existing remote-session public lifecycle projection, per-source freshness and coverage, separate requested and observed evidence, deterministic next-actor routing, and explicit unavailable measurements.

The offline fixtures cover assigned through merged work, waiting and failure paths, stale and unavailable sources, unlinked process observations, and a strictly covered no-work state. Adversarial cases fail closed on enum/field drift, cross-session or worktree joins, stale live claims, timestamp and head mismatches, unauthorized display labels, missing measurements serialized as zero, and oversized identifiers.

This PR adds no Board UI, lifecycle producer, Slack mapping, cloud event or field, network action, provider mutation, or lease mutation. It remains draft for the v1.4.0/v1.4.1 release ordering and must not advance main while the active Devin critical path is open.

Validation at exact head 0feb5f98374622956bbc71158c6a1147a0df253c:

• 15 focused contract tests passed under both unittest and pytest
• 348 relevant Board, remote-session, package tests and 572 subtests passed
• full supported unittest suite passed: 3,004 tests, 11 skipped
• repository-wide Ruff, compile, privacy scan, and diff checks passed
• wheel and sdist builds passed; the wheel includes the module and schema
• GitHub CI package matrices for Python 3.12, 3.13, and 3.14 passed
• code-mower/gate passed
• independent Code Mower Claude exact-head audit: PASS, P0=0, P1=0, P2=0, P3=0 (evidence)

Closes #946

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 0feb5f98374622956bbc71158c6a1147a0df253c
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

New, additive, self-contained board_observation contract module with a closed JSON-Schema, extensive validation logic, and 17 valid + 13 adversarial fixtures exercising the invariants (timestamp ordering, identity binding, freshness/staleness, primary-route determinism, measurement null-vs-zero semantics, privacy scrubbing of display labels). package_manifest.py change is purely additive. No correctness, security, or contract-violation blockers found.

Findings: none.