test(solmara): prove contract generation transitions

[jeremi]

What changed

• use the real registryctl version pinned by versions.env for authority project check, test, and deterministic runtime comparison in normal CI
• add just up-generated as the documented clean-checkout generate, verify, and start journey
• add a release-candidate-only SRO blue, mixed, and successor generation proof
• require the mixed Notary to fail on the exact Relay contract pin before Relay execution or source dispatch
• scan generated closures and captured proof output for credentials and the exercised synthetic subjects without echoing matches
• preserve bounded, redacted failure diagnostics and the primary failure when cleanup also fails

Why

PRs #9 and #10 established the compiler-generated Relay and Notary topology, but issue #8 still lacked real compiler coverage in normal CI, one clean-checkout command, and live evidence that a mixed contract generation fails closed before source work.

Developer impact

Contributors can now run just up-generated from a clean checkout. Normal CI verifies all six authority projects with the published pinned compiler, while the slower Docker transition proof stays in the release-candidate workflow.

Validation

• live just contract-generation-proof
• just registry-projects-check
• just registry-projects-test
• just registry-projects-runtime-check
• just lint
• just test
• just compose
• just review
• 10 focused contract-generation proof tests
• independent review, including a clean final re-review

Progresses #8. The issue should remain open until this PR's CI and the final pinned release-candidate evidence pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 377d5f6ecc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use the supported Compose no-tty flag

In the release-candidate proof, this counter query runs after the blue evaluation, but Docker Compose's current exec reference documents -T, --no-tty as the option to disable TTY allocation, not --no-TTY (see Docker docs: https://docs.docker.com/reference/cli/docker/compose/exec/). On runners with the current Compose CLI, this exec invocation is rejected before psql runs, so just contract-generation-proof fails before it can validate the mixed-generation transition.

Useful? React with 👍 / 👎.