docs: record the runtime-package version contract (#20)

[andrescera]

What

Rule-A follow-up for PR #20 (chore(release): 1.5.6+ceralive.1 + package-contract tests), which extended package-contract.sh with real version/metadata locks but
left AGENTS.md silent about them.

Adds the current package version to the runtime-package bullet and a
"Runtime-package version contract" subsection listing exactly what the static gate
locks.

Why

AGENTS.md is the routing layer for this repo and it named no package version
at all, so there was nothing to check a drift claim against — the version lived
only in build-deb.sh and two workflows.

Two things are easy to get wrong and are now written down:

• The package version (1.5.6+ceralive.1) and the Provides version (= 1.5.6)
  are deliberately DIFFERENT strings. The Provides must match the upstream
  version Debian's libsrt1.5-gnutls/-openssl would satisfy, because that is
  what lets this package replace both flavours instead of co-installing beside
  them — which is the single-fork invariant the whole device runtime rests on.
• The + in the version is not cosmetic. apt's https method percent-encodes it to
  %2B while R2 stores the literal +, which 404'd every +-versioned .deb
  on-device until apt-worker Add note about building library dynamically to obey LGPL Haivision/srt#23 keyed lookups on the decoded path. Cross-linked
  so the next person changing this version sees that consequence.

How to verify

The gate is static (reads packaging sources and workflows; no build needed):

$ bash packaging/package-contract.sh
package-contract: OK (1.5.6+ceralive.1 / Provides (= 1.5.6))

Every value in the new table is one the script asserts, so the doc cannot drift
from the packaging without the gate going red.

Risks

None — documentation only. No packaging, workflow, or script change.