feat: implement OKF v0.2 spec (provenance, trust, lifecycle, attested computations)

[akeemjenkins]

Upstream updated the OKF spec to v0.2 (SPEC.md last touched 2026-07-24). This PR closes the delta between the CLI (which implemented v0.1) and the current spec. Built test-first: every rule below landed as a failing test before its implementation.

Parsing (internal/concept)

• New frontmatter families: sources with credibility signals (author, usage_count, last_modified) and usage_window incl. per-entry override (§5.1); generated/verified (§5.2); status/stale_after (§5.4-5.5); Attested Computation contract runtime, parameters, computation, executor, attester (§10.2)
• A bare verified mapping is treated as a one-element list, as §5.2/§11 require; malformed shapes are tolerated as empty so one bad concept cannot kill a bundle load
• Trust tiers (§5.3), actor-kind classification (§7), EffectiveStatus defaulting to stable, IsStale (today >= stale_after), and GeneratedAt with legacy timestamp fallback (§13.1)
• tags now tolerates the comma-separated scalar form found in upstream's own generated bundles (consumers MUST NOT reject, §11) - previously this failed the whole bundle load

Validation (internal/validate)

Errors (MUST / REQUIRED-within-family violations): missing runtime on Attested Computation, generated without by, sources entry without resource, invalid status value, malformed stale_after, non-ISO log.md date headings (§9), frontmatter in a non-root index.md (§8).
Warnings (SHOULD / legacy): legacy timestamp and # Citations (§13.1), stale concepts, actor-convention violations, verified entries missing by/at, usage_count without a framing usage_window, footnote labels that do not join into sources[].id (§5.1), missing computation (no inline section and no computation path) or both provided (§10.3), contract paths pointing at files that do not exist (§6.2), unknown okf_version (§12), extra root-index frontmatter keys.

Graph

Path-valued fields (§6.2) now produce derivation edges when they resolve to concepts: sources[].resource (§5.1 lineage), computation, executor.resource, attester.resource. Bare root-relative paths (the form used by the spec's §10.2 example and upstream bundles) resolve via a bundle-root fallback.

index / init / CLI surface

• okf init declares okf_version: "0.2" in the root index.md; okf index preserves an existing declaration when regenerating (and never adds one implicitly)
• okf show surfaces status, trust_tier, stale, generated, verified, stale_after, sources, usage_window, and the full computation contract
• okf list adds status and trust_tier per concept; okf schema descriptions updated

Verification

• 88 tests pass (race included), golangci-lint clean, gofmt clean (tree-wide gofmt included)
• All four upstream reference bundles (acme_retail, crypto_bitcoin, ga4, stackoverflow) load and validate with 0 errors; the stackoverflow warnings are genuine §5.1 positional-footnote issues in the upstream data
• Note: the previously-fatal stackoverflow bundle (scalar tags) now loads

🤖 Generated with Claude Code