feat(schema-guard): govern source reads and registry effects

[qq2401672073-hub]

Summary

• add the exact schema-guard runx skill with typed compatibility outputs
• read the current schema from an immutable allowlisted source at runtime
• append and read back a registry event bound to the compatible verdict digest
• refuse breaking, malformed, truncated, and unreachable sources before any append
• vendor canonical web-fetch and data-store stages for a self-contained install

Verification

• node --test skills/schema-guard/tests/*.test.mjs — 36 passed
• runx-cli 0.7.2 package harness — 5 cases passed, 0 assertion errors
• compatible path: fetch, evaluate, append, readback, terminal projection
• breaking/unreachable paths: no append or readback

Implements Frantic bounty #84's real-source and consumed-effect requirements.