feat(artifacts): reconcile composite group identities

[Chumaniac]

What changed

Allow keyed_integer_sum_equals to identify a group with two to four ordered string columns while preserving the existing single-string key behavior. An organization-local order ID can now be reconciled as [tenant_id, order_id], so a total-preserving transfer between organizations is rejected instead of passing under a shared order ID.

Composite components use unambiguous byte-length framing, retain exact string semantics, and each count toward the existing 100,000-cell budget. Reports expose declared column names and aggregate findings without raw keys or values. Invalid, unsafe, or capacity-limited observations remain unknown.

Source version is 0.1.6. GitHub 0.1.4 and npm 0.1.0 remain the existing published artifacts; no package publication is part of this PR.

Safety boundary

• No credentials, private data, host mounts, ambient environment, or provider capabilities added.
• Malformed key declarations fail before artifact reads.
• Existing single-key behavior, safe integers, bounded storage, closed observers, and source identity checks preserved.

Verification

• Tests: 587 passed; one optional Docker test remains skipped.
• Type check, lint, and build passed.
• Local 0.1.6 archive: 341 entries; packaged CLI validates shipped composite fixture and pre-read same-file rejection. No publication occurred.
• Regression coverage includes organization collisions, tuple framing/order/aliases, exact Unicode strings, invalid schemas, capacity, unknown results, and redacted findings.
• Real local restricted SkillTape producer → delivery → consumer journey accepts the correct synthetic artifacts and rejects two shifted groups. Single-key controls accept both, exposing the intended difference.

Documentation

• README, contract guide, tenant fixture, changelog, and roadmap updated.
• Actual prose language and documentation links reviewed. The unchanged Unicode payload test and two deliberately invalid reference fixtures retain their failure semantics.