feat: sourceos-indexd status/explain stubs + WorkstationActionBoundary contract

[mdheller]

Closes #162, #163

sourceos index status/explain stubs (#162)

• sourceos index status [--json] — returns stub JSON with queue_depth, generation, failed_extractors, paused_lanes, policy_denied_count
• sourceos index explain --file <path> — returns stub JSON per file with last_observed_event, path_policy, extractor_identity, receipt_status, generation_membership
• Both are local-only, no network calls, no analytics
• Stable JSON shape; existing doctor/status checks unaffected

WorkstationActionBoundary contract + validator (#163)

• contracts/workstation-action-boundary.schema.json — records the boundary between observation, planning, policy, and mutation; enforces that doctor/report artifacts cannot claim mutation_performed, fix plans cannot skip policy refs, and every mutation requires before/after evidence
• contracts/validate-workstation-boundary.py — rejects collapsed records; validates all six negative fixture cases from the issue
• Valid examples: doctor_report, applied_fix
• Invalid examples (validator rejects): doctor_report claiming mutation, applied_fix without policy_decision_refs
• No new live mutation behavior introduced