Add canonical public transition manifest classifier

[Brandon Miller (brandom-msft)]

Summary

• Add the P5-owned canonical v1 path-classification manifest with locked first-match rule ordering.
• Add the sole production schema validator and p5-posix-v1 matcher as importable functions plus the deterministic classify JSON CLI.
• Add required path-derived delegation metadata to every private-workflow-dependent rule; stable rule IDs, not array indexes, identify each target contract.
• Add contract coverage for schema/enums, all rules and current repository paths, glob semantics and rejection, path normalization, duplicates, precedence, delegation, malformed value types, digest/order determinism, unresolved output/exit status, import use, and the golden P4 consumer.

Contract

• Defaults are unresolved / none / unresolved; unresolved paths are emitted and return exit 1.
• Malformed schemas, including unhashable enum values, produce controlled stderr without a traceback and return exit 2.
• Matching is full-path, case-sensitive, repository-relative POSIX with explicit *, ?, **, and zero-segment **/ behavior.
• Delegation modes are tracked-sample-yaml-roots and rule-root; roots must be normalized, non-glob paths covered by their owning rule.
• Hosted Agents delegation discovers tracked sample.yaml roots under the declared language root. Current public proof is 4 Python roots and 0 C# roots.
• Bicep delegates one rule-root target: infrastructure/infrastructure-setup-bicep.
• The manifest contains no volatile per-target inventory.
• .github/** intentionally classifies the canonical manifest and matcher as internal-only for private promotion.
• Unknown or newly introduced roots remain unresolved until the canonical manifest is deliberately updated.

Validation

• python -m pytest .github/tests/test_public_transition_manifest.py -q — 128 passed.
• Repository Black environment — clean.
• Ruff 0.9.10 check — clean (the existing tox command uses the retired pre-0.1 CLI form, so the installed tox environment executable was invoked with check).
• Production-shaped classification — all 2,907 current repository paths resolved; canonical manifest SHA-256 24602504243488913565121fb51a4978ddcbefafeecf45bf901160565935bd99.

Dependency and sequencing

P4/private helper production wiring remains fail-closed until this PR lands. This PR does not modify P4-owned readiness fields or consumers, workflows, settings, or environments.

ADO

ADO 5449714

Documentation impact

• Current behavior: unchanged. This draft establishes target contract surfaces only and makes no docs-current claim.
• Target contract paths: .github/public-transition-manifest.json and .github/scripts/public_transition_manifest.py.
• PR/SHA proof: this draft PR at head commit 94fe10eb86bf7ec7a77b4f334fdf61e387a2b5f9; tests are .github/tests/test_public_transition_manifest.py.
• Ownership: P5 owns classification, delegation metadata, and matching; P4 owns readiness fields, live target enumeration, and consumer behavior.