Add shared entitlement push contract

[danifronter]

Summary

• define the canonical signed v1 entitlement push payload in the shared SDK
• bind tenant_ref to tenant_id and preserve empty limits as a JSON object
• add wire round-trip and validation regression coverage

Verification

• composer verify (38 tests, 106 assertions)