feat(openontology): implement OpenOntology Phase 0 + local engine and CLI (#99)

Implements OpenPRD 0001 through Phase 0 (specification, schemas, example,
docs surface) and Phase 1 (local engine, CLI, conformance tests).

Schemas (17 contracts, JSON Schema Draft 2020-12, additionalProperties:false)
  manifest, namespace, entity-type, property, relationship-type, constraint,
  query, action, entity, claim, source, evidence, changeset, review, approval,
  event, package — registered in @logicsrc/validators and exported from
  @logicsrc/schemas under https://logicsrc.com/schemas/openontology/.

@logicsrc/openontology
  - canonical JSON + sha256 package digests; YAML, JSON, NDJSON, and inline
    authoring all compile to the same bytes, so digests are authoring-agnostic
  - id profile: compact / IRI / urn with one canonicalization rule, prefix
    bound by a Namespace object so IRIs reverse unambiguously
  - validation: schema, graph (domain/range, datatypes, dangling refs),
    provenance (source-or-firstParty, agent runId, derivation inputs), policy
    (excerpt limits, licensing, visibility, staleness) and declared
    constraints; four severities, stable codes, text/json/yaml/markdown
  - portable triple-pattern query AST: multi-hop, 14 operators, asOf and
    recordedAsOf, per-status filtering, distinct/order/limit, explanation
    mode, and enforced depth/binding/row limits
  - append-only store: claims are immutable; dispute/retract/supersede append
    status transitions and the effective status is the latest one
  - change sets: 9 operations, atomic pre-flight, conflict detection on stale
    base revisions, semantic diff with duplicate-identity warnings and
    affected-query deltas, per-operation reviewer decisions
  - policy: agents propose but can never apply — the denial keys on actor
    type, so every scope plus high confidence plus --yolo still cannot apply;
    merges need approval, bulk retractions need two, undeclared action side
    effects are denied
  - JSON-LD 1.1 export/import with PROV-O aliases and lossy-field reporting
  - pluggable signature envelope with a jws-ed25519 reference profile and a
    fail-closed trust policy

CLI: logicsrc ontology init|validate|lint|build|inspect, entity, claim, query,
changeset, import, export, audit. Reads take --format, writes default to a
proposal, exit codes are stable for CI.

Example: examples/openontology/ethereum-ecosystem — 12 entity types, 17
relationship types, 63 entities, 169 claims, 25 sources, 31 evidence records,
5 saved queries, every claim lifecycle state, and a pending merge proposal.
All data is fictional; the directory is removable without affecting any core
test.

Docs: docs/openontology{,-governance,-interoperability}.md, a real
/openontology route, homepage + nav + sitemap entries, and a root README
section.

Verification: 112 new tests; full monorepo build and every workspace test
pass; conformance bundle (18 valid + 13 invalid fixtures) runs against the
published schemas alone; Node.js 25 and Bun 1.3 produce byte-identical
digests, revisions, event trails, and query results.

Not included (later PRD phases): MCP resources, REST/SSE, Turso adapter, TUI
and PWA surfaces, RDF/SHACL mappings, source adapters, governed actions.

Refs: prd/0001-add-logicsrc-openontology-spec.md

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/schemas/fixtures/openontology/conformance.json

@@ -0,0 +1,158 @@
+{
+  "openontologyConformance": "0.1",
+  "description": "Conformance fixtures for LogicSRC OpenOntology. A third-party implementation can run these against the published JSON Schemas with no LogicSRC code: every valid fixture must validate, every invalid fixture must fail.",
+  "valid": [
+    {
+      "fixture": "valid/manifest.json",
+      "kind": "openontology-manifest"
+    },
+    {
+      "fixture": "valid/namespace.json",
+      "kind": "openontology-namespace"
+    },
+    {
+      "fixture": "valid/entity-type.json",
+      "kind": "openontology-entity-type"
+    },
+    {
+      "fixture": "valid/property.json",
+      "kind": "openontology-property"
+    },
+    {
+      "fixture": "valid/relationship-type.json",
+      "kind": "openontology-relationship-type"
+    },
+    {
+      "fixture": "valid/constraint.json",
+      "kind": "openontology-constraint"
+    },
+    {
+      "fixture": "valid/query.json",
+      "kind": "openontology-query"
+    },
+    {
+      "fixture": "valid/query-adhoc.json",
+      "kind": "openontology-query"
+    },
+    {
+      "fixture": "valid/action.json",
+      "kind": "openontology-action"
+    },
+    {
+      "fixture": "valid/entity.json",
+      "kind": "openontology-entity"
+    },
+    {
+      "fixture": "valid/claim-relationship.json",
+      "kind": "openontology-claim"
+    },
+    {
+      "fixture": "valid/claim-value.json",
+      "kind": "openontology-claim"
+    },
+    {
+      "fixture": "valid/source.json",
+      "kind": "openontology-source"
+    },
+    {
+      "fixture": "valid/evidence.json",
+      "kind": "openontology-evidence"
+    },
+    {
+      "fixture": "valid/changeset.json",
+      "kind": "openontology-changeset"
+    },
+    {
+      "fixture": "valid/review.json",
+      "kind": "openontology-review"
+    },
+    {
+      "fixture": "valid/approval.json",
+      "kind": "openontology-approval"
+    },
+    {
+      "fixture": "valid/event.json",
+      "kind": "openontology-event"
+    }
+  ],
+  "invalid": [
+    {
+      "fixture": "invalid/claim-both-objects.json",
+      "kind": "openontology-claim",
+      "mustFail": true,
+      "reason": "A claim object carries an entity reference or a typed value, never both."
+    },
+    {
+      "fixture": "invalid/claim-unknown-status.json",
+      "kind": "openontology-claim",
+      "mustFail": true,
+      "reason": "status must be one of the six declared claim states."
+    },
+    {
+      "fixture": "invalid/claim-confidence-out-of-range.json",
+      "kind": "openontology-claim",
+      "mustFail": true,
+      "reason": "confidence must be between 0 and 1."
+    },
+    {
+      "fixture": "invalid/claim-extra-property.json",
+      "kind": "openontology-claim",
+      "mustFail": true,
+      "reason": "Undeclared properties are rejected; extensions must go in the namespaced extensions object."
+    },
+    {
+      "fixture": "invalid/entity-missing-canonical-name.json",
+      "kind": "openontology-entity",
+      "mustFail": true,
+      "reason": "canonicalName is required on every entity."
+    },
+    {
+      "fixture": "invalid/manifest-no-maintainer.json",
+      "kind": "openontology-manifest",
+      "mustFail": true,
+      "reason": "At least one maintainer is required."
+    },
+    {
+      "fixture": "invalid/manifest-bad-version.json",
+      "kind": "openontology-manifest",
+      "mustFail": true,
+      "reason": "Package versions must be semantic versions."
+    },
+    {
+      "fixture": "invalid/manifest-bad-id.json",
+      "kind": "openontology-manifest",
+      "mustFail": true,
+      "reason": "Package ids are lowercase kebab-case."
+    },
+    {
+      "fixture": "invalid/relationship-no-range.json",
+      "kind": "openontology-relationship-type",
+      "mustFail": true,
+      "reason": "A relationship type must declare at least one allowed object type."
+    },
+    {
+      "fixture": "invalid/evidence-unknown-selector.json",
+      "kind": "openontology-evidence",
+      "mustFail": true,
+      "reason": "Evidence selectors must use one of the declared machine-readable shapes."
+    },
+    {
+      "fixture": "invalid/changeset-empty-operations.json",
+      "kind": "openontology-changeset",
+      "mustFail": true,
+      "reason": "A change set must contain at least one operation."
+    },
+    {
+      "fixture": "invalid/changeset-unknown-op.json",
+      "kind": "openontology-changeset",
+      "mustFail": true,
+      "reason": "Hard deletion is not an operation; use retract-claim or archive-entity."
+    },
+    {
+      "fixture": "invalid/action-no-permissions.json",
+      "kind": "openontology-action",
+      "mustFail": true,
+      "reason": "Actions must declare the scopes they require."
+    }
+  ]
+}