architecture: canonicalize runtime profile and contract foundation

[rickisba]

Motivation

• Canonicalize ownership of runtime identity and KDN v1 contract foundations to support phased package migration and avoid duplicate implementations.
• Provide dependency-light, importable packages for RuntimeProfile and KDN v1 contract primitives so other services can depend on stable, wheel-installable modules.
• Preserve backward compatibility by keeping identity-preserving shims under kdn_server.contracts and kdn_server.domain while surfacing the canonical objects under cacheroute.*.

Description

• Added src/cacheroute/runtime/profiles.py and src/cacheroute/runtime/__init__.py containing the canonical RuntimeProfile (values, normalize, resolve_startup, and resolve_auto) that delegates normalization to cacheroute.compat.runtime.normalize_runtime_profile.
• Added src/cacheroute/contracts/v1/common.py, src/cacheroute/contracts/v1/errors.py, src/cacheroute/contracts/v1/__init__.py, and src/cacheroute/contracts/__init__.py implementing the canonical KDN v1 contract foundation (constants, SupportState, ContractModel, VersionedMessage, GatewayTargetedRequest, TokenReference, TokenInput, OutcomeCode, and ContractError alias) with preserved wire values and validation behavior.
• Converted kdn_server/contracts/common.py and kdn_server/contracts/errors.py into import-only forwarding shims that re-export the canonical objects from cacheroute.contracts.v1, and updated KDN modules to import the canonical contracts and runtime profile instead of local duplicates (production imports were updated where required, e.g. gateway and cache-service contract references).
• Updated kdn_server/domain/models.py to import RuntimeProfile from cacheroute.runtime and removed the duplicate RuntimeProfile definition from that file.
• Updated pyproject.toml explicit setuptools package list to include cacheroute.runtime, cacheroute.contracts, and cacheroute.contracts.v1 while keeping transitional packages.
• Added focused tests test/test_contract_foundation.py and adjustments to existing governance/namespace tests to assert canonical/legacy identity, serialization/validation parity, shim-only modules, support-state truthiness, outcome wire values, and dependency-light import isolation.
• Left knowledge- and cache-service-specific contract implementations in place under kdn_server.contracts (they now import the canonical foundation); no migration of knowledge.py or cache_service.py implementations beyond updating imports.

Testing

• python3 -m compileall -q src kdn_server test completed successfully.
• python3 -m pytest -q test/test_repository_governance.py passed (8 passed).
• Focused namespace tests ran with mixed results: selected dependency-light checks reported 4 passed, 4 failed, 2 deselected; the failing cases failed during import because pydantic (and other heavy deps) were not available in the environment rather than due to forbidden dependency imports.
• The new identity/behavior tests were added and exercised where possible, but full collection of test/test_contract_foundation.py and related suites was blocked by missing test dependencies (pydantic, numpy) and by package-index/network restrictions (HTTP 403) which prevented installing requirements and building wheels in this environment.
• Fresh-process dependency-isolation for cacheroute.runtime passed (no forbidden modules loaded when importing canonical packages from an isolated process).
• Building a wheel and isolated-wheel validation could not be completed because setuptools.build_meta and other build-time dependencies were unavailable due to the blocked package index, so wheel path/size and isolated-install assertions are not available from this run.

Closes #172
Refs #159
Refs #157

---

Codex Task