Hold the model and its published schemas to one accept/refuse corpus

[ExtraToast]

Parent

#221

What to build

The committed JSON Schemas, not zod's byte output, become the contract a second implementation is held to. Each published schema, and the Project and Platform schemas, gets a corpus of valid and invalid instances, and a test proves the model and the committed schema agree on every one: both accept the valid instances, both refuse the invalid ones.

The existing check that the committed schema equals the generator's output stays: it proves the current generator's output is committed. The new corpus is what any other generator would be judged by, since a different generator will never match byte for byte.

Record the decision as an ADR: the committed schemas and their accept/refuse corpus are the contract; byte equality is a property of the current generator only.

Acceptance criteria

• Every committed JSON Schema has valid and invalid instances, the invalid ones covering at least an unknown field, a missing required field, a wrong type, an out-of-range enum value and a union mismatch.
• A test validates every instance against both the committed schema and the model, and fails on any disagreement; a fixture proves it fails when the two disagree.
• The ADR is written to this repository's ADR contract, and npm run lint:adrs passes.

Blocked by

• Keep the metamodel to what JSON Schema can state #223