[0.3.0-A] Operation registry, dry-run planning, save policy, and schema compatibility

[mberrys]

Problem
Loupe now has multiple machine-readable contracts, but version numbers alone do not define compatibility. A report, operation plan, or provenance chain must remain readable after application upgrades, and unsupported major versions must fail explicitly rather than being partially interpreted.
Technical direction

struct PDFSchemaVersion
{
    quint16 major = 1;
    quint16 minor = 0;
};

enum class PDFCompatibility
{
    Compatible,
    UpgradeRequired,
    UnsupportedMajor,
    Invalid
};

PDFCompatibility checkCompatibility(PDFSchemaKind kind,
                                    PDFSchemaVersion producer,
                                    PDFSchemaVersion consumer);

Rules:

• major change may break readers;
• minor change is additive and must preserve unknown fields on pass-through where required;
• every persisted object identifies schema kind/version;
• unsupported versions fail closed with a diagnostic;
• current and previous supported versions have golden fixtures;
• migrations are explicit, pure, deterministic, and tested.
  Acceptance criteria
• Compatibility matrix covers preflight report, profile, evidence, operation plan/result, audit event, certificate, capability discovery, and package manifest.
• Current and previous supported fixtures round-trip.
• Unknown major versions fail explicitly.
• Minor additive fields do not break older compatible consumers.
• Migration output is deterministic and provenance records the migration.
• CLI and Core expose identical compatibility diagnostics.
  Dependencies: [0.3.0-A] Add profile import, export, versioning, and provenance #132, [0.2.0 trust-contract] Canonical preflight verdict reducer shared by every surface #234, [0.3.0-C] Converge operation history and certified-preflight state onto one provenance chain #237, [0.2.0] Build a shared Evidence Graph so checks reuse one page traversal #240.