Upgrade seed types from any declared starter baseline

[callumalpass]

Implements Connect's side of mdbase-spec 05A seed-upgrade baselines: mdbase-dev/mdbase-spec#59 (f5f5743).

What changed

@mdbase-dev/connect-protocol

• upgrade_from on a type-pack manifest resource is one baseline or a non-empty list of { digest, document, version? }. This applies to mdbase-app.schema.json and to connect-protocol.v1.schema.json, which previously had no upgrade_from at all, so devkit-built packs could not carry one. The single-object form is unchanged.
• New validateTypePackProvision(value, path?) in ./manifest. It holds the existing resource-set and digest checks, now shared by validateAppManifest and the devkit, plus the 05A baseline rules: seed types only; digest = sha256(document); distinct digests; not the resource's own digest; same type kind and name as the desired document; version, if present, equals the document's. Issues point at the offending baseline, e.g. /provisions/type_packs/0/manifest/resources/0/upgrade_from/2/digest. The kind/name/version checks parse frontmatter with yaml, which is now a protocol dependency (already used by devkit, sync, ui, editor and server).
• TypePackResourceDiff.upgrade_baseline and receipt resources' origin_digest.

mdbase-connect-protocol (Rust): TypePackManifestResource.upgrade_from is now Option<Value>, passed through verbatim, and the single-baseline TypePackSeedUpgradeBase struct is removed. Connect never read it: the pack digest covers the exact form, and mdbase validates it. A test round-trips both forms and checks them against the schema.

@mdbase-dev/connect (client SDK): TypePackResourceDiff.upgradeBaseline and receipt originDigest, translated in wireTypePackResource/wireTypePackReceipt.

@mdbase-dev/connect-dev: defineTypePack accepts upgradeFrom: [{ document, version? }] on resources. It computes the digests, defaults version to the one the document declares, always emits the list form, and validates with validateTypePackProvision.

Editor: requireGuidedPersonSetup accepts a seed type update only when the engine-reported upgradeBaseline.digest is one of the bundled resource's declared baselines (single or list). Before, it checked installedDigest against the single upgrade_from. merged is now currentDigest !== upgradeBaseline.digest. If the engine preserves the Person seed with a reason (05A step 5: origin unknown or unlisted), setup returns { kept: true } and the panel shows Person type kept as it is in place of the review button, so the "update available" row no longer loops. Everything else is still rejected as before.

Portal: type and copy for list baselines and kept types. Docs: docs/portable-people.md, devkit README, CHANGELOG.

Fixtures

In apps/editor/src/test/person-starter-upgrade.assessment.json, the upgradeBaseline and originDigest values and the whole new unknownOrigin case are hand-constructed from the spec until the engines report them. merged now assumes a lock that records the v2 origin. unknownOrigin's assessment and lock digests are placeholders.

Merge ordering

• Until the engine bump, the current mdbase-rs pin reports no upgrade_baseline, so the Editor's v2→v3 Person upgrade would stop for review in Types. Land this with or after the Connect engine bump.
• Lists are rejected by engines older than 05A.

Verification

• pnpm ci:local --node (Node 24): everything passes except check:architecture. See below.
• protocol node tests 77/77, client 666, devkit 15, editor 536 (65 files), connect-protocol Rust 71, clippy and fmt clean on the crate.

Architecture budget: needs approval

typeScriptExportDeclarations is 2692; its reviewed budget is 2691 (+1, from the new exported validateTypePackProvision, which keeps the devkit from running a second validator). The budget is not raised here. Rust public declarations went down by 3 (3368 → 3365).