Add .sourceos/manifest.json: declare agentplane as SourceOS agent-execution component

[mdheller]

Summary

• Adds .sourceos/manifest.json to register agentplane as a first-class SourceOS component
• Domain: agent-execution — the execution control plane bridging bundle intent to SourceOS image production surfaces (Tekton, Katello)
• policyClass: critical — agentplane owns stop-gate evaluation and live Tekton mutation surfaces
• ownedSchemas: Bundle, GovernanceContext, ValidationArtifact, PlacementDecision, RunArtifact, ReplayArtifact, StopGateArtifact, SourceOSContextToolProviderEvidence, SourceOSContextCuminRun
• dangerousSurfaces: sourceos.delegated.live_tekton_mutation (--execute-live path), bundle.stop_gate.override

Integration path context

The agentplane ↔ sourceos-syncd integration path is:

1. agentplane bundle defines intent: ISO build target, Katello content ref, Tekton pipeline, policy lane
2. Tekton executes: builds ISO, publishes to Katello file repo, emits bootReleaseSetRef + releaseSetRef
3. run_sourceos_delegated.py records katelloContentViewRef, katelloLifecycleEnvironmentRef, bootReleaseSetRef in RunArtifact/ReplayArtifact — the evidence boundary
4. Operator promotes content view qa → stable in Katello (manual today; Phase 2 target for automation)
5. sourceos-syncd polls Katello stable, detects version bump, runs nix copy with minisign verification, emits SyncCycleReceipt
6. sourceos-boot health-check timer validates boot chain; rolls back if check fails

Test plan

• python3 scripts/validate_bundle.py bundles/sourceos-image-production-smoke/bundle.json still passes
• CI passes (no schema validation touches .sourceos/)