[antoinetoussaint-byte]

Release Core v0.19.17 with installation declarations and signed manifest carriage. version/info.codefly.yaml is bumped in this PR; the maintained version-tag workflow creates the immutable tag only after the merged main commit passes codefly core.

Contracts can now declare the agent's installation_role and presence-only edge_dependencies. Core validates canonical values and carries them through Encode/Resolve into solutionhost.Authority and its signed canonical payload. Absent fields preserve existing bytes; none declares no standing grant. Existing empty-role/installer rules remain unchanged, and dependencies are never inferred from binding IDs.

This is a fix in the contract and manifest owner, implementing Product's frozen v4 (bc416a2c), plus the accepted v10 clarification that dependency identity is the exact signed module principal resolved through the existing host catalogue; the earlier f5f8 serialization proposal is superseded. The signed carrier reuses the contract dependency type and preserves declaration order without defaulting or a second validator. docs/module-contract.md and docs/module-manifest.md describe the behavior and ownership boundaries.

Validation: both focused package suites, race, vet and whitespace checks pass. All 144 contract fixtures and eight new rule-deletion witnesses pass. Accepted kit fixtures consistently declare assistant, so consumers render the shipped bytes unchanged through their principal guard; a regression check enforces that convention. Tests protect legacy encoded/canonical bytes and exercise real sign/verify round trips: both declarations survive, and altering either invalidates the signature.

Full suite and end-to-end installation/deployment have not been run locally. CLI must populate both signed documents from the same resolved values. Generated Authority bindings, paired producer/reader roundtrip and mismatch handling remain downstream gates; this Core carrier alone does not qualify delivery. No image or CVE changes. Startup protocol 2, agent protocol 1 and advertised capabilities/operation contracts are unchanged; this release alone requires no fleet rebuild. CLI installation delivery still requires the paired Authority producer/reader qualification described above.