feat: platform release manifest v1 + open-core licensing boundary (Sections 13 + 22)

[abrichr]

Summary

Implements roadmap Section 13 (one signed platform release manifest, pragmatic v1) and Section 22 (licensing/contribution boundary) in the launcher meta-repo, which is where the platform pins already live.

Section 13: platform release manifest

• platform-manifest.json (repo root): one authoritative, versioned-schema (v1.0.0), machine-readable manifest listing launcher/flow/capture/desktop versions, PyPI artifact URLs + sha256 digests, supported OSes, substrate drivers, compatibility ranges, qualification-evidence IDs (pointing at https://openadapt.ai/status.json and the flow evidence-pack manifests), and release channel.
• scripts/generate_platform_manifest.py: generates the manifest from the REAL published sources (PyPI JSON API, live status.json, this repo's pyproject.toml). Fails loudly on drift or unreachable sources rather than inventing numbers.
• scripts/validate_platform_manifest.py: CI drift detector. Today it validates structure, signature honesty, agreement with pyproject.toml, and exact version/URL/sha256 agreement with PyPI for all four components; status.json skew is a warning by default (--strict-status escalates). Later: sigstore signature verification and OS installer artifacts (documented in docs/platform-manifest.md).
• Signing is NOT faked: signature is present in the schema but honestly null with status unsigned (signing infrastructure pending). The validator REJECTS any non-null signature value until verification infrastructure exists. The Authenticode / Apple Developer ID / sigstore rollout plan is documented.
• CI: .github/workflows/platform-manifest.yml runs the validator on PRs, pushes to main, and a weekly schedule (so an unregenerated manifest fails loudly after any component release).

Section 22: licensing and contribution boundary

• TRADEMARKS.md: name/logo not covered by MIT, nominative use OK, no confusingly similar names, contact for permission.
• scripts/check_source_boundary.py: denylist path-token + content-signature check that keeps application-specific recipes, customer fixtures, and proprietary system identifiers out of public core repos (motivating case named in the docstring: the PowerChart incident). Complements flow's packaging-time check_release_consistency.py by scanning the repository tree at PR time. Wired into the same CI workflow; accepts --root so other public repos can reuse it.
• CONTRIBUTING.md: documents the open-core boundary for contributors and states that the DCO applies now, with a CLA under consideration but not adopted.

Verification

• Generator run against live PyPI + status.json produced the committed manifest (launcher 1.7.3, flow 1.23.0, capture 1.1.1, desktop 0.14.0).
• Validator passes online (1 expected warning: status.json still lists desktop 0.13.0 while PyPI has 0.14.0) and offline.
• Boundary check passes across all 335 tracked files.
• New scripts are ruff-clean and ruff-format-clean.

DO NOT MERGE without maintainer review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM