feat(contracts): initial implementation (v1.0.0)

Introduces code.nochebuena.dev/einherjar/contracts — the zero-dependency
foundation of the Einherjar framework. Defines the interfaces and minimal
types consumed by every starter. Zero external dependencies. Zero Einherjar
dependencies. Nothing is above it in the dependency graph.

lifecycle:
- Component — OnInit, OnStart, OnStop three-phase lifecycle hooks

observability:
- Level (LevelCritical=0, LevelDegraded); zero value is the safe default
- Checkable — HealthCheck, Name, Priority
- Identifiable — ModulePath, ModuleVersion; implemented by all starters to
  surface module identity and version in the startup banner

logging:
- Logger — Debug, Info, Warn, Error, With, WithContext

errs:
- CodedError — ErrorCode() string; satisfied by core/xerrors.Err
- ContextualError — ErrorContext() map[string]any; satisfied by core/xerrors.Err

security:
- Identity value type — UID, TenantID, DisplayName, Email; NewIdentity, WithTenant
- Permission (int64), MaxPermission=62, PermissionMask — Has, Grant
- PermissionProvider — ResolveMask(ctx, uid, resource) (PermissionMask, error)
- SecurityBag value type — immutable request-scoped security context; carries
  Identity and arbitrary typed attributes (hardware IDs, grant codes, etc.);
  With copies the attribute map on every call to preserve receiver-invariant behaviour
- NewSecurityBag, Identity, WithIdentity, Get, With
- SetBagInContext / BagFromContext — full bag context storage
- SetInContext / FromContext — backed by SecurityBag; all four cross-function
  combinations (SetInContext+BagFromContext, SetBagInContext+FromContext) are valid

One file per type; CT-6 enforced by compliance test AST walk.

errs/coded_error.go

@@ -0,0 +1,12 @@
+package errs
+
+// CodedError is implemented by errors that expose a machine-readable error code.
+// The core starter's Logger implementation consumes this interface to append
+// error_code to structured log records. The core starter's xerrors implementation
+// satisfies it via its ErrorCode method.
+type CodedError interface {
+	// ErrorCode returns a machine-readable identifier for the error condition.
+	// Values are SCREAMING_SNAKE_CASE strings meaningful to frontend consumers
+	// (e.g. "USER_NOT_FOUND"). Internal errors must not carry a code.
+	ErrorCode() string
+}

errs/contextual_error.go

@@ -0,0 +1,12 @@
+package errs
+
+// ContextualError is implemented by errors that expose structured key-value context
+// fields. The core starter's Logger implementation consumes this interface to append
+// context fields to structured log records. The core starter's xerrors implementation
+// satisfies it via its ErrorContext method.
+type ContextualError interface {
+	// ErrorContext returns a map of structured fields attached to this error.
+	// Keys are strings; values may be any type representable in a log record.
+	// The returned map must not be modified by the caller.
+	ErrorContext() map[string]any
+}

errs/doc.go

@@ -0,0 +1,4 @@
+// Package errs defines the interfaces implemented by structured errors in the
+// Einherjar framework. These interfaces replace the private duck-typed bridges
+// previously used between logz and xerrors, enforcing the contract at compile time.
+package errs