Establish the canonical Control Program ABI

[bigboateng]

Summary

• add one strict public loader for complete repository-owned Control Programs
• validate and normalize typed executable semantics before SHA-256 fingerprinting
• qualify transition and recovery identities as program-id/local-id
• fail closed on unknown fields, duplicate keys, unsupported schemas, incompatible runtimes, and unavailable capabilities
• separate program version and runtime compatibility from the executable semantic fingerprint
• replace the PrimaryFlow terminology with ProgramRuntime for execution bindings; Flow remains the product name for a complete Control Program

Boundary

Repository source crosses into executable Kernel policy only after strict parsing, semantic validation, canonicalization, compatibility verification, and immutable registry construction. Capability declarations never grant authority.

Conformance evidence

• semantic mutations change the fingerprint
• whitespace, JSON key order, declaration order, program-version-only changes, and compatible minimum-runtime changes remain stable
• duplicate and ambiguous identities fail closed
• two programs using the same local transition ID do not collide
• the Kernel consumes the exact validated, fingerprint-bound registry
• 158/158 sharded Go tests
• complete race suite
• Go vet and build
• 27 Python repository-contract tests
• release-note validation and committed preflight
• git diff check

Release note

Added release-notes/2026-08-11-control-program-abi.md.

This is a flag-day interface change. No compatibility aliases or migration layer are included.