Implement reviewed fleet convergence

[szmyty]

Closes #2.

Outcome

Implements PAC-02 as a general, contract-driven convergence path. Pace now consumes pinned Hygiene catalog membership, Holon foundation/materialization intent, current and desired Pace locks, and Observatory's organization-health snapshot to produce deterministic, human-reviewable repository upgrade units.

What changed

• add v1 fleet manifest, convergence plan, exact review, and bounded upgrade-PR contracts
• pin the live Hygiene catalog, Holon materialization, and merged Observatory organization-health revisions
• compare current and desired lock entries as additions, removals, updates, and lock-policy changes
• explain categorical risk and topologically order repository-sized upgrade units
• block stale, unknown, mixed, or ambiguous Observatory state instead of guessing
• require exact Holon plan coverage when generated targets drift
• support explicit pause, dependency completion, partial-fleet approval, idempotent retry, and reverse-plan rollback
• verify a local candidate's base, allowlisted paths, prior bytes, desired lock, generated digests, and Holon state
• open exactly one non-default-branch pull request only after exact review; never update or merge the default branch
• document the operator lifecycle and update the active architecture/roadmap evidence

Authority boundary

Planning and proposal generation are offline and credential-free. The open-pr adapter is the only network/write path. It refuses a moved remote base, an unexpected candidate path, a mismatched prior or desired digest, a different retry tree, or a retry commit without the reviewed base parent. Merge remains human-owned.

Acceptance evidence

• Catalog, manifest, lock state: pinned input contracts plus closed fleet-manifest joins
• Dry-run drift, risk, ordering: deterministic plan and exact source/unit digests
• One PR per bounded unit: one repository unit, deterministic branch, exact candidate allowlist
• Pause, retry, rollback, partial adoption: manifest pause state, idempotent branch/tree reuse, preserved prior lock/Holon evidence, review-selected unit subsets

Validation

• 32 Python tests pass, including all existing suites
• Ruff check and format pass for the new implementation and tests
• 10 schemas/contracts/examples validate with Draft 2020-12 JSON Schema
• 3 pinned upstream contract locks match the exact live default-branch commits and file SHA-256 digests
• fixture plan generation and independent verification pass
• all checked JSON parses and git diff --check passes

Roadmap-Step: PAC-Q04