feat(openontology): implement OpenOntology Phase 0 + local engine and CLI (#99)

Implements OpenPRD 0001 through Phase 0 (specification, schemas, example,
docs surface) and Phase 1 (local engine, CLI, conformance tests).

Schemas (17 contracts, JSON Schema Draft 2020-12, additionalProperties:false)
  manifest, namespace, entity-type, property, relationship-type, constraint,
  query, action, entity, claim, source, evidence, changeset, review, approval,
  event, package — registered in @logicsrc/validators and exported from
  @logicsrc/schemas under https://logicsrc.com/schemas/openontology/.

@logicsrc/openontology
  - canonical JSON + sha256 package digests; YAML, JSON, NDJSON, and inline
    authoring all compile to the same bytes, so digests are authoring-agnostic
  - id profile: compact / IRI / urn with one canonicalization rule, prefix
    bound by a Namespace object so IRIs reverse unambiguously
  - validation: schema, graph (domain/range, datatypes, dangling refs),
    provenance (source-or-firstParty, agent runId, derivation inputs), policy
    (excerpt limits, licensing, visibility, staleness) and declared
    constraints; four severities, stable codes, text/json/yaml/markdown
  - portable triple-pattern query AST: multi-hop, 14 operators, asOf and
    recordedAsOf, per-status filtering, distinct/order/limit, explanation
    mode, and enforced depth/binding/row limits
  - append-only store: claims are immutable; dispute/retract/supersede append
    status transitions and the effective status is the latest one
  - change sets: 9 operations, atomic pre-flight, conflict detection on stale
    base revisions, semantic diff with duplicate-identity warnings and
    affected-query deltas, per-operation reviewer decisions
  - policy: agents propose but can never apply — the denial keys on actor
    type, so every scope plus high confidence plus --yolo still cannot apply;
    merges need approval, bulk retractions need two, undeclared action side
    effects are denied
  - JSON-LD 1.1 export/import with PROV-O aliases and lossy-field reporting
  - pluggable signature envelope with a jws-ed25519 reference profile and a
    fail-closed trust policy

CLI: logicsrc ontology init|validate|lint|build|inspect, entity, claim, query,
changeset, import, export, audit. Reads take --format, writes default to a
proposal, exit codes are stable for CI.

Example: examples/openontology/ethereum-ecosystem — 12 entity types, 17
relationship types, 63 entities, 169 claims, 25 sources, 31 evidence records,
5 saved queries, every claim lifecycle state, and a pending merge proposal.
All data is fictional; the directory is removable without affecting any core
test.

Docs: docs/openontology{,-governance,-interoperability}.md, a real
/openontology route, homepage + nav + sitemap entries, and a root README
section.

Verification: 112 new tests; full monorepo build and every workspace test
pass; conformance bundle (18 valid + 13 invalid fixtures) runs against the
published schemas alone; Node.js 25 and Bun 1.3 produce byte-identical
digests, revisions, event trails, and query results.

Not included (later PRD phases): MCP resources, REST/SSE, Turso adapter, TUI
and PWA surfaces, RDF/SHACL mappings, source adapters, governed actions.

Refs: prd/0001-add-logicsrc-openontology-spec.md

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/openontology/src/index.ts

@@ -0,0 +1,117 @@
+/**
+ * @logicsrc/openontology — reference implementation of the LogicSRC
+ * OpenOntology standard.
+ *
+ * This package IMPLEMENTS the standard; it does not define it. The normative
+ * contracts are the JSON Schemas published in @logicsrc/schemas under
+ * https://logicsrc.com/schemas/openontology/. Any implementation that
+ * satisfies those schemas and the conformance suite conforms, whether or not
+ * it uses a single line of this code.
+ */
+
+export { OPENONTOLOGY_VERSION } from "./types.js";
+export type * from "./types.js";
+
+export { canonicalize, canonicalObject, digest, packageDigest } from "./canonical.js";
+
+export {
+  createIdFactory,
+  idForm,
+  idPrefix,
+  isValidId,
+  isVariable,
+  revisionId,
+  toIri,
+  type IdForm
+} from "./ids.js";
+
+export {
+  buildOntologyPackage,
+  loadOntologyPackage,
+  verifyPackageDigest,
+  PackageLoadError,
+  SCHEMA_SECTIONS,
+  DATA_SECTIONS,
+  type LoadInput
+} from "./package.js";
+
+export {
+  renderReport,
+  validateOntologyPackage,
+  type ReportFormat,
+  type ValidateOptions
+} from "./validate.js";
+
+export {
+  DEFAULT_LIMITS,
+  evaluateQuery,
+  validAt,
+  QueryLimitError,
+  type KnowledgeView,
+  type QueryLimits
+} from "./query.js";
+
+export {
+  createMemoryStore,
+  type ClaimFilter,
+  type EntityFilter,
+  type EntityMatch,
+  type OntologyStore,
+  type StatusTransition
+} from "./store.js";
+
+export {
+  evaluatePolicy,
+  localActor,
+  proposerActor,
+  readOnlyActor,
+  SCOPES,
+  type Actor,
+  type Operation,
+  type PolicyDecision,
+  type PolicyOptions,
+  type Scope
+} from "./policy.js";
+
+export {
+  applyChangeSet,
+  diffChangeSet,
+  ChangeSetApplyError,
+  ChangeSetConflictError,
+  type ApplyContext,
+  type ApplyResult,
+  type SemanticDiff
+} from "./changeset.js";
+
+export {
+  buildContext,
+  exportJsonLd,
+  importJsonLd,
+  packagePrefix,
+  OO,
+  PROV,
+  type JsonLdExport
+} from "./jsonld.js";
+
+export {
+  createEd25519Provider,
+  generateEd25519KeyPair,
+  signDigest,
+  verifyDigestSignature,
+  verifyPackageSignatures,
+  type SignatureProvider,
+  type VerificationResult
+} from "./signature.js";
+
+export {
+  createOntologyEngine,
+  OntologyApprovalError,
+  OntologyNotFoundError,
+  OntologyPermissionError,
+  type EngineOptions,
+  type Explanation,
+  type ExplainedClaim,
+  type OntologyEngine
+} from "./engine.js";
+
+export { initOntologyPackage, type InitOptions, type InitResult } from "./scaffold.js";