feat(validation): staged-verification funnel — contract + execution gates

Gate 2 (contract) and Gate 4 (execution) of the 4-gate staged-verification
design, plus the two gate-quality fixes found in live QA.

- Gate 2: KindContractTable (kind→assertions registry, universal floor,
  additive project overrides) + KindInference (path→kind, pure/replay-safe)
  + ContractAssertion model; ContractGateEvaluatedEvent (registered);
  ContractAssertionEvaluator seam + FileSystemContractEvaluator (FS/TEXT,
  COMPILER skipped); runContractGate in runPostStageGates — a stage that
  produces file_written artifacts must have every declared+written file
  exist/non-empty/parse, else retryable hand-back with per-assertion feedback.
- Option A: ExecutionPlanCompiler puts concrete (non-glob) plan `writes` into
  StageConfig.expectedFiles, so a declared-but-unwritten file fails file_exists.
- Gate 4: BuildExpectation enum (none|module|project|tests) + plan field +
  closed-set compiler validation; runExecutionGate resolves the alias against
  the bound project profile commands and runs it as a deterministic gate.
- Live-QA fixes: react_entry kind so main.tsx/index.tsx aren't required to
  export a default component (was an unwinnable false-positive); JSONC
  tolerance (allowComments/allowTrailingComma) so tsconfig.json passes valid_json.

Seams are null on the replay harness (no-op) — recorded events are truth (#9).

apps/server/src/main/kotlin/com/correx/apps/server/Main.kt

@@ -38,6 +38,7 @@ import com.correx.core.kernel.orchestration.OrchestrationProjector
 import com.correx.core.kernel.orchestration.OrchestrationRepository
 import com.correx.core.kernel.orchestration.OrchestratorEngines
 import com.correx.core.kernel.orchestration.ProcessStaticAnalysisRunner
+import com.correx.core.kernel.orchestration.FileSystemContractEvaluator
 import com.correx.core.kernel.orchestration.OrchestratorRepositories
 import com.correx.core.kernel.orchestration.WorkspaceContext
 import com.correx.core.kernel.orchestration.WorkspaceTools
@@ -324,6 +325,7 @@ fun main() {
         workspacePolicy = workspacePolicy,
         workspaceToolRegistryProvider = wsToolRegistryProvider,
         staticAnalysisRunner = ProcessStaticAnalysisRunner(),
+        contractAssertionEvaluator = FileSystemContractEvaluator(),
     )
     val decisionJournalRepository = InfrastructureModule.createDecisionJournalRepository(eventStore)
     val defaultOrchestrationConfig = OrchestrationConfig(