feat: add portable business decision contracts

[abrichr]

Purpose

Add portable contracts for finite, qualified business decisions. This contract remains separate from operational halt actions.

Contract

• bind the exact tenant, runner, run pause, workflow, bundle, qualification, presentation, role policy, expiry, renewal, relay, and idempotency context
• expose only finite option IDs in the signed task and answer envelopes
• classify every presentation text field as local_only or reviewed_remote_safe
• require a positive egress-review digest for every remotely displayed field
• bind the exact presentation and review digest in the signed delivery policy
• keep screenshots, OCR, live record values, and free-form notes outside the portable remote task
• report only that an answer was recorded; never claim that the downstream business effect is verified
• preserve the existing operational Execute decision webhook and add the typed business task as a schema_version-discriminated alternative

Validation

• 275 tests passed
• focused business-decision and Execute tests passed
• source-boundary validation passed
• exact wheel and source archive built
• all five business-decision JSON schemas are present in both package archives

Release order

This remains a draft until independent review and exact-head CI pass. Publish the corresponding openadapt-types release before dependent Flow or Cloud integration merges.

[abrichr]

Independent review finding on exact head 5cb8affd9d46e3efa03f20f80ecbcebf6034542d (blocking): BusinessDecisionPresentationV1 is an exported portable contract, but question and option label accept arbitrary printable text. reviewed_safe_for_remote=True is only a model literal. The signed policy binds the bytes, but it does not prove that they contain no live values. Exact-head reproduction accepted Approve live patient John Smith, MRN 123456? and labels containing the same name while reporting reviewed_safe_for_remote=true. The test test_cloud_safe_contract_has_no_free_text_or_sensitive_extension misses this because it treats any regex-constrained string as non-free text.

If the remote contract must structurally exclude live record values, keep arbitrary copy outside the portable remote contract and use a closed, qualification-owned presentation/template reference or another structurally safe vocabulary. Otherwise, narrow the contract claim and replace the false-assurance test with a test of the actual signed review boundary. I cannot confirm the requested no-live-value invariant on this head.

[abrichr]

Exact-head correction pushed as 2669866. The arbitrary-text reviewer case is now local-only and remote admission refuses it. Every remote presentation field requires REVIEWED_REMOTE_SAFE plus a positive egress-review digest that matches the signed delivery policy. The Execute decision webhook now uses a schema_version-discriminated union and preserves the existing operational payload. Please re-review this exact head.