feat(api): derive project summaries and resolve exact ontology modules from verified packages #1744

Sub-issue of #1732. Depends on the discovery contract sub-issue.

Scope

Rust facade functions (feature discovery) on top of the extended discovery contract:

• A storage reader that finds a participant's file in a portable-v2 package through the runtime map and reads it bounded and digest-verified (bundle and expanded). It never follows symlinks.
• summarize_verified_portable_v2: fully verifies a package, then reads only the workspace/research_metadata and workspace/configuration participants. It builds a ProjectSummary from the public-safe projection plus package facts. The projection is one exhaustive destructuring function, so adding a feat(analyst): add research Project metadata and discovery #1348 field fails to compile until someone decides whether it is public. Publishers and verifiers get identical canonical bytes.
• resolve_discovered_ontology_module: validates and binds manifest and refs, selects the module descriptor by exact identity, fully verifies the module package, requires package_digest and module identity to match, reads the module document, and recomputes its domain-separated canonical digest. Discovery and binding errors come before any package read.

PortableV2Report keeps its current shape, so binding receipts do not change.

Acceptance

• Two Projects that adopt the same exact module resolve to the same module identity, the same document bytes and the same module sha256. Their package_digests differ legitimately because source_generation differs. Tested with real durable projects.
• Summary bytes are identical for bundle and expanded representations of the same package. collaborators, extensions and discovery_facets never appear. Local paths and project identity are never consulted.
• A tampered module byte fails verification. An absent identity fails with missing_object. A descriptor pointing at the Project package is rejected before any package I/O.
• A summary with an unknown required capability fails with unsupported_future without touching the package path.