Adopt plugin-neutral source and state contracts

[Aaronontheweb]

Netclaw needs a plugin-neutral foundation before it imports package formats.

This change adds managed source IDs, canonical GitHub sources, durable receipts, rejection state, and manifest identity fields.

The source supports auto, agent-plugin, and codex formats. New sources use auto.

The change also adds the shared PRD, specification, glossary terms, and OpenSpec change.

Validation:

• This branch builds against the current dev branch.
• The full stack passed 8,588 tests and skipped 23 environment-specific tests.
• OpenSpec strict validation passed.
• Slopwatch found no issues.
• The file-header and diff checks passed.

Part of #2134.

Pull request stack

Review and merge these pull requests in this order:

1. Adopt plugin-neutral source and state contracts #2160: Adopt plugin-neutral source and state contracts.
2. Add Agent Plugins and Codex package adapters #2161: Add Agent Plugins and Codex package adapters.
3. Publish managed plugins during external sync #2162: Publish managed plugins during external sync.
4. Add the managed plugin daemon API #2157: Add the managed plugin daemon API.
5. Add the managed plugin CLI #2158: Add the managed plugin CLI.

This pull request is step 1.

[Aaronontheweb]

Adversarial review complete.

I found and fixed a portable path validation gap. The validator now rejects Windows device aliases and other nonportable segments.

The focused configuration tests pass. I found no remaining defect in this slice.

[Aaronontheweb]

I found no defect that is specific to this slice. Source validation, schema sync, canonical references, and durable receipt state match the current Codex scope. The stack-level PRD and OpenSpec gap remains. I reported that gap on #2158.

[Aaronontheweb]

The direction is sound. This slice defines plugin-neutral sources, durable receipts, schema support, and the approved OpenSpec change.

I found no defect that is specific to this slice. Higher stack layers still need corrections before merge.

I reviewed commit 07023f6. Local checks passed with 8,588 tests, strict OpenSpec validation, Slopwatch, headers, and diff checks.

Local evals lacked provider credentials. Chromium lacked a usable sandbox for native tapes. GitHub checks are still active.