Add remote broker API contract

[NavinAgrawal]

Summary

• add contract-only Phase 3 remote API validators for authenticated discovery, describe, call, status, cancellation, streaming chunks, and audit events
• require auth_context, tenant_context, and policy_decision before accepting remote request shape
• document that network_listener_supported remains false and no listener, hosted worker, upstream call, or runtime mutation is added

Verification

• private make precommit PYTEST_WORKERS=0: 1383 unit passed, 152 journey passed, 0 failed, 0 skipped
• private make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 test-file-size advisories
• private make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0
• public make precommit PYTEST_WORKERS=0: 1383 unit passed, 118 journey passed, 0 failed, 0 skipped
• public make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 test-file-size advisories
• public make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0

Mutation was not run locally to avoid saturating the Mac.