feat(manifest): add exact schema version routing

[stacknil]

Summary

• add one immutable registry for exact run-manifest/v1 and run-manifest/v2 schema selection
• fail closed on missing, malformed, blank, case-changed, whitespace-changed, or unknown version markers
• add a reviewer CLI, representative v1/v2 fixtures, compatibility tests, and contract documentation

Why

The repository documents both strict v1 and current v2 run-manifest contracts, but readers previously had no executable selection policy. A consumer could therefore hard-code one schema or invent a newest-version fallback. This PR makes the embedded marker authoritative before shape validation.

This is intentionally a reader-side contract change. Artifact-diff workflow work remains out of scope.

How to validate

python scripts/check_release_contract.py
python scripts/validate_run_manifest.py tests/fixtures/run_manifests/v1.json
python scripts/validate_run_manifest.py tests/fixtures/run_manifests/v2.json
python scripts/validate_run_manifest.py data/processed/run_manifest.json

Local result before push: 216 tests passed; 29 committed artifacts matched regenerated output; all three validation commands selected the expected schema.

Design and risk

• Design decision: telemetry_lab.run_manifest_contract.RUN_MANIFEST_SCHEMA_REGISTRY is the single authoritative marker-to-schema mapping. select_run_manifest_schema() performs exact lookup before JSON Schema validation; the CLI is a thin adapter.
• Main risk: a future schema version will be rejected until it is deliberately added to the registry and compatibility tests. This explicit failure is preferable to silently validating against the wrong contract.
• Compatibility impact: current writers still emit only run-manifest/v2; strict v1 and v2 schema files, generated artifacts, aggregate digests, and runtime dependencies are unchanged. Historical v1 inputs gain an explicit supported reader path. The CLI uses the existing dev-only jsonschema dependency.
• Rollback path: revert the three commits in this PR. No migration, backfill, dual-write state, or generated artifact rollback is required.

Screenshots / GIF

Not applicable; there is no UI change.

[stacknil]

Post-CI diff review completed at eebba4a.

• Checks: CI and Repo Sentinel passed for both push and PR runs.
• Design decision: exact embedded-marker lookup through one immutable registry before schema-shape validation.
• Main risk: future versions fail closed until deliberately registered and covered by compatibility fixtures.
• Compatibility impact: reader-only addition; writers remain v2-only, v1/v2 schemas and committed artifacts are unchanged, and no runtime dependency was added.
• Rollback path: revert the three semantic commits; no migration, backfill, artifact regeneration, or dual-write rollback is needed.
• Final diff review: no unexpected files, private identifiers, local paths, secrets, generated artifact changes, or scope overlap with the separate artifact-diff work.

The report/schema behavior change remains open for the required spaced review; it is intentionally not being merged immediately.

[stacknil]

Spaced review completed on 2026-08-22 at unchanged head eebba4a and base ecb0bb2.

• Independent compatibility gate: 14/14 router tests passed; representative v1 and v2 manifests selected only their exact schemas; unknown run-manifest/v999 failed closed with exit 1.
• Full release contract: 216/216 tests passed and all 29 committed artifacts matched regenerated output.
• Delayed diff review: 7 expected files only; remote PR diff matches local origin/main...HEAD; the registry remains the sole selection authority and the CLI does not implement fallback or caller-controlled schema paths.
• Privacy/security review: no local paths, private identifiers, secrets, schema mutations, writer mutations, runtime dependency changes, or committed artifact changes were introduced.
• Environment note: Windows emitted an ignored scratch-directory cleanup warning after artifact regeneration; the gate exited 0 and the tracked worktree remained clean.

No blocking comments or reviews were present. The delayed review requirement is satisfied; this PR is ready for the repository's trusted admin-merge flow.