Keep artifact trust loop copies on owner install route

[8Dionysus]

Problem

The local os-abyss-artifact-trust-loop skill copies needed an explicit owner managed install route so they are not interpreted as portable release artifacts. This PR records that boundary and refreshes the generated companions from the exact source.

Changes

• document and contract the os-user-default managed-copy path as an owner source projection;
• update the skill port manifest and owner README;
• regenerate generated/contract_abi_signatures.min.json;
• regenerate the portable KAG family and its index-family budget receipt with the CI pinned aoa-kag source;
• refresh the generated family once more from the exact CI pin after the first CI sentinel identified generator drift.

Validation

• owner home-port validator, ABI, artifact signature policy, manifest, topology, schema, path-policy, and repository diff checks: passed;
• exact CI-pinned KAG portable-family generator --check, sentinel, full parity, family contract, and compatibility assembly: passed;
• full owner claim/evidence graph with pinned aoa-sdk and aoa-stats, using a short TMPDIR: passed;
• public smoke suite: 1963 passed;
• all five requested evidence items satisfied, including fresh-install projection and public smoke corpus;
• checkpoint review-note recorded for commits 453d3494, 7e06d8c5, 3d61c9f3, and 4f66c21a.

Skips and limits

• aoa-skills validate_skills was not applicable because this owner tree has no schemas/skill-frontmatter.schema.json.
• This PR does not claim host/service/install mutation, artifact admission, runtime health, publication, or deployment.
• The final KAG receipt records +9,528,914 bytes across 107 changed files and a tracked family size of 30,393,580 bytes versus the 27,262,976 standing budget; no standing budget policy change is included.