feat(profiles): publish curated tool profile declarations

[szmyty]

Closes #5

Summary

• add bounded cloud, flutter, git, and media profiles; compose them into full without service capabilities
• replace the placeholder Nix/Homebrew pins and record immutable source, license, platform, security, owner, and review evidence for accepted tools
• make stable admission executable: an accepted tool must map to a capability resolved by its owning profile; experimental and rejected entries cannot name a stable capability
• publish deterministic per-profile contents, declared-intent SPDX inventories, cache keys, size-evidence state, and a platform support matrix
• update the base lock metadata for the expanded catalog while retaining the existing 13-package base payload

Validation

• python3 tools/realm_profiles.py validate-catalog
• python3 tools/realm_profiles.py validate-profiles
• python3 tools/realm_tool_registry.py validate
• python3 tools/realm_profile_publications.py check
• python3 tools/realm_apt_packages.py check
• python3 -m unittest discover --start-directory tests --pattern "test_*.py" --verbose (55 passed)
• python3 -m compileall -q tools tests
• bash -n images/base/scripts/install-apt-packages images/base/scripts/realm-packages images/base/scripts/verify-apt-packages images/base/tests/smoke.sh
• git diff --check

task check could not run locally because Task and ShellCheck are not installed in this workspace; CI installs both.