[Readiness 1/5] Define the versioned system-readiness report contract

[jyaunches]

Parent epic: #7407

Outcome

Define the supported, versioned contract for a read-only NemoClaw system-readiness report before implementation is exposed through the CLI.

This issue is intended to map to PR 1 of the system-readiness stack.

Scope

• Define the top-level report envelope and JSON Schema.
• Define observations, capabilities, qualifications, findings, and provenance.
• Define stable identifier conventions.
• Define present, absent, and unknown semantics.
• Define severity, exit-code, and no-mutation semantics.
• Define schema compatibility and unknown-major behavior.
• Add representative golden fixtures for supported and incompatible systems.
• Document which fields are stable contract versus bounded diagnostic evidence.

The contract should be consumer-neutral and must not mention scenario-framework concepts or provider control planes.

Acceptance criteria

• A checked-in JSON Schema validates every golden fixture.
• The report carries schema version, NemoClaw version, immutable source revision when available, observation time, and mutated: false.
• Required facts distinguish absent from unknown.
• Stable IDs do not depend on human titles or remediation prose.
• Unknown schema majors fail closed for consumers.
• The contract describes deterministic exit codes.
• Evidence is bounded and explicitly outside compatibility decisions unless referenced by a stable capability or finding.
• Tests cover forward-compatible optional fields and rejected incompatible schema changes.

Non-goals

• No public CLI wiring in this PR.
• No change to onboarding behavior.
• No platform-specific remediation.
• No guarantee for arbitrary raw command output.

Related work

• Epic: unify warnings, advisories, and fatal exits under a single registry #3213
• refactor(advisories): add structured registry foundation #6945
• refactor(advisories): migrate host remediation checks #7167
• Define a stable machine-readable onboarding and progress protocol #6403
• fix(security): redact token-shaped values from sandbox doctor --json output #7356