ci(contracts): capture pinned OpenCLI descriptive schemas in isolation

Run only bounded version/help probes from npm OpenCLI 1.8.8 with lifecycle scripts disabled.
Retain package provenance, hashes and descriptive artifacts; do not invoke website operations.

Author: loong10k

.github/workflows/upstream-contracts.yml

@@ -0,0 +1,46 @@
+name: Pinned upstream descriptive contracts
+on:
+  push:
+    branches: ['feature/2.0.x-contract-hardening']
+    paths: ['.github/workflows/upstream-contracts.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  capture:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Install pinned OpenCLI without lifecycle scripts
+        shell: bash
+        run: |
+          mkdir -p upstream-evidence "$RUNNER_TEMP/opencli-prefix" "$RUNNER_TEMP/opencli-isolated-home"
+          npm view @jackwener/opencli@1.8.8 version gitHead dist --json > upstream-evidence/npm-provenance.json
+          npm install --prefix "$RUNNER_TEMP/opencli-prefix" --ignore-scripts --no-audit --no-fund --save-exact @jackwener/opencli@1.8.8
+      - name: Capture only bounded version and structured help
+        shell: bash
+        run: |
+          export HOME="$RUNNER_TEMP/opencli-isolated-home"
+          CLI="$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/dist/src/main.js"
+          timeout 20 node "$CLI" --version > upstream-evidence/version.txt
+          timeout 20 node "$CLI" --help -f json > upstream-evidence/root-help.json
+          for namespace in browser daemon auth skills plugin adapter profile; do
+            timeout 20 node "$CLI" "$namespace" --help -f json > "upstream-evidence/$namespace-help.json"
+          done
+          cp "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/cli-manifest.json" upstream-evidence/cli-manifest.json
+          cp "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/package.json" upstream-evidence/package.json
+          tar -czf upstream-evidence/opencli-package.tar.gz -C "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli" dist/src cli-manifest.json package.json
+          node --version > upstream-evidence/node-version.txt
+          date -u +%FT%TZ > upstream-evidence/captured-at.txt
+          (cd upstream-evidence && sha256sum *.json *.txt *.tar.gz > SHA256SUMS)
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: opencli-1.8.8-descriptive-${{ github.sha }}
+          path: upstream-evidence
+          retention-days: 14
+          if-no-files-found: error