Define the carve-changesets operating contract

[shaug]

TL;DR

Defines the normative carve-changesets contract that the remaining #28 implementation children will follow.

Summary

• Preserve the established changeset model, cognitive-load guardrails, additive-first ordering, rename separation, feature-flag policy, database migration rules, immutable source, and final equivalence guarantee.
• Define truth promotion from proposed plan entries through materialized commits, published PRs, and merged mainline state.
• Specify the plan_ready, chain_ready, prs_open, all_merged, and blocked terminal states with candidate-bound evidence.
• Establish decompose-only, publish, and merge-and-propagate authority, including strict force-with-lease and base/source protection.
• Bound the review-code-change and babysit-pr seams while keeping decomposition and propagation ownership here.
• Require a plain git/GitHub stack whose only durable skill metadata lives in commit trailers and PR metadata blocks.

Non-goals

• No script changes.
• No SKILL.md authoring.
• No changes to the frozen skills/prepare-changesets reference implementation.
• No backwards compatibility for old state files, plans, or chains.

Validation

• Clean base: just lint — pass.
• Candidate: just format — pass.
• Candidate: just lint-md — pass.
• Candidate: just test — pass (179 unit tests plus 2 eval cases).
• Candidate: git diff --check — pass.
• Repository-owned review-code-change — clean at edeb2f5f5f7b4cfa4e73e8289d34157b192f92ab versus 4570e9093fdce85eeec90e62869f02b9104cf1d2 after one correctness fix/re-review cycle.

Issue #29 has an explicit, issue-only exception to the repository-wide candidate just lint gate: clean-base just lint plus candidate just lint-md, just test, just format, and git diff --check satisfy validation for this intentionally incomplete pre-packaging child. Full candidate just lint would require the future SKILL.md that #29 explicitly forbids and a later child owns. This exception authorizes no SKILL.md, script, justfile/lint-discovery, frozen prepare-changesets, sibling, ticket-body, dependency-graph, manual-transition, parent-close, deployment, production, or destructive changes.

Tickets

Fixes #29