Add model carry authorization boundary

[mdheller]

Summary

Adds ModelCarryAuthorizationBoundary so local model profiles are mechanically treated as carry/reference objects, not authorization objects.

This applies the lifecycle-boundary discipline now established across AgentPlane, Guardrail Fabric, Agent Registry, Model Governance Ledger, Prophet Platform, SourceOS Spec, SyncD, and AgentTerm.

Adds

• contracts/model-carry-authorization-boundary.schema.json
• examples/model-carry-authorization-boundary.local-llama32-1b.json
• examples/model-carry-authorization-boundary.prompt-egress.invalid.json
• examples/model-carry-authorization-boundary.download.invalid.json
• tools/validate_model_carry_authorization_boundaries.py
• docs/model-carry-authorization-boundary.md

Updates

• Makefile
  • adds validate-model-carry-boundary
  • wires it into make validate

Boundary encoded

A valid carry boundary may carry profile/service refs and emit evidence, but it must not authorize:

• prompt egress;
• network access;
• tool use;
• model download;
• training on user data;
• model promotion;
• model lifecycle mutation.

Negative fixtures reject prompt-egress authorization and automatic model-download authorization.

Boundary

This PR does not implement model execution, router decisions, model download, prompt egress, network access, tool access, personal tuning, or model promotion. It only hardens the carry-layer contract so later implementation work cannot treat a profile as authorization.