Vendor & publish consumed snapshots (TapirXL, Viper)

[xnorkl]

Parent: #187 — Pillar A

Goal

Bring the consumed upstream contracts (TapirXL, Viper) into the registry as versioned packages.

Acceptance criteria

• TapirXL upload-vector.vrl + golden vendored as a versioned package with source URL + fetch timestamp
• Viper OpenAPI vendored as a versioned package with source URL + fetch timestamp
• A documented refresh procedure exists for intentional updates
• If an upstream source is unreachable in CI, the job fails loudly rather than publishing a stale or empty package

Notes

• Blocked by Define contract-package format & repo layout #189 (format must be defined first).
• Upstream fetchability is validated by Spike: validate the contract distribution & verification approach #188.