feat: add canonical SRAC projection and needs adapter

[devashridatta-dotcom]

Summary

Adds the first focused implementation slice for portable safety traceability:

• a canonical SRAC projection and validation contract;
• a read-only Sphinx-Needs needs.json adapter;
• deterministic generated fixtures and an integrity-bound SBOM reference manifest; and
• focused Bazel/pytest coverage, including fail-closed source-vocabulary cases.

The lifecycle source remains authoritative. The exporter does not infer, create, review or approve a safety decision.

Scope boundary

Included:

• supported S-CORE source vocabulary: QM, ASIL_B and ASIL_D;
• missing safety data exported as undetermined / not-assigned;
• rejection of conflicting or unsupported source classifications;
• stable source identifiers and exact needs.json digest;
• deterministic SRAC and reference-manifest generation; and
• CI execution through //srac:srac_projection_tests.

The source-vocabulary contract and fail-closed behavior are documented in
srac/NEEDS_EXPORT.md. A canonical S-CORE process reference can replace or
supplement that adapter-level reference when maintainers identify the governing
process document.

Excluded from this PR:

• the Persistency and Lifecycle Health Monitor PoC pilots;
• receiving-tool ingestion or UI changes;
• autonomous safety decisions or approvals;
• digital signatures and attestations; and
• promotion of the complete srac_poc branch.

Architecture dependency

This PR is intentionally a draft and is blocked on acceptance or maintainer direction from:

• docs: propose portable safety traceability and SBOM exchange score#3318 — proposed portable safety traceability design
  decision (DR-009);
• Proposal: Define a minimum SRAC profile for an S-CORE pilot score#3282 — S-CORE safety-relevance discussion; and
• docs: define policy-aware safety traceability use cases #393 — policy-aware use cases.

The implementation can be adjusted to the canonical metamodel and mapping-overlay decision before it is marked ready for review.

CI integration

This PR adds //srac:srac_projection_tests to
.github/workflows/internal_tests.yml so the deterministic projection, schema
validation, source-digest verification and negative cases are exercised on
every pull request.

Test

bazel test //srac:srac_projection_tests

The focused suite checks deterministic projection, source-of-truth provenance, integrity-protected references, report preservation and negative cases for missing, contradictory and unsupported classifications.

[github-actions]

The created documentation from the pull request is available at: docu-html