Adopt spec v0: capability set, typed failures, zone vocabulary/binding split

[MJohnson459]

Adopts the three Augere v0 specifications across Mote's control plane, in three
independently reviewable commits.

1 — the contracts as shared modules (mote_bringup/spec/). mission.py,
capability.py and zone.py implement the specs' payloads, ROS-free and
stdlib-only, in mote_bringup for the reason bundle.py is there: the task
layer executes missions, the agent bridges them and the off-board server
dispatches them, and none of the three may depend on the others. Three rules
are enforced here rather than left to callers because each fails silently in a
caller — terminal is computed from state rather than supplied, failure is
refused anywhere but rejected/failed, and recoverable must be stated
for the spec's three "depends" classes, where a class-level default would be a
guess wearing a contract's clothes. The input validator is a bounded subset of
JSON Schema whose acceptable property is that it raises on a keyword it does
not implement: an ignored maxItems is a promise nothing keeps, quietly,
forever.

2 — a capability set and typed failures on the wire (mote/v2). A robot is
told a capability key and a typed input, not fetch red_box dropoff; a refusal
carries a class and a recoverability, not a sentence. That is a change of
meaning in an existing payload, so by protocol.py's own rule the topic root
moves. The capability set is published by the task server and forwarded by the
agent — never authored — so a robot whose task server is down advertises
nothing, which is true; the dashboard's dispatch form is generated from it, with
a zone picker exactly where a property's schema $refs zone/v0's zone
reference, so the page holds no list of capabilities and no list of which inputs
are places. The lane moved to the executor, which is the thing that actually
holds it; dispatch.py kept dedup, an hour of retention, the no-verdict
timeout and source, and lost its prose parser. Preconditions are now
evaluated rather than documented: a goto sent to an unlocalised robot is
refused with a reason instead of flailing in Nav2.

3 — the zone vocabulary/binding split. A floor is two documents:
vocabulary.yaml (what the places are called — no coordinates, safe to
broadcast) and binding.yaml (this robot's poses, stamped with platform_id,
frame_id and map_revision). The vocabulary is built from the fields it may
carry, never stripped of the ones it may not, because stripping holds only until
someone adds a geometry key and forgets. What it buys is a distinction the robot
could not draw: a name in the vocabulary this robot has never been taught now
resolves unbound — "I know that place, nobody has driven me there" — where
before it was unknown_name, which sent an operator hunting for a typo that was
not there. Migration is a side effect of writing, never a step. A revision
carries the binding; a candidate from the zone editor carries both halves and
promotion lifts its vocabulary to the floor, so "uploading is not publishing"
now covers names as well as coordinates.

Verification

710 passed, 10 skipped across mote_bringup, mote_tasks and mote_fleet in
the dev environment — the tier with a real mosquitto, so the M1 acceptance
(test_e2e_fleet.py) and the map registry's publish/promote/pull ran against
the new wire and the new layout end to end. test_e2e_fleet.py now also covers
the capability set reaching the broker and unresolved_zone, invalid_input
and busy coming back classified with the mission holding the lane named.

test_spec_conformance.py validates payloads built by these modules against
the specification's own JSON Schemas — all 8 mission states, all 11 failure
classes, command, cancel, the capability set, and all four zone documents. 10
passed against augereai-spec 3895f02 with jsonschema 4.26. Mote vendors no
copy of those schemas; the test skips where the checkout or the library is
absent.

One conformance finding is recorded rather than papered over: zone/v0 requires
a pose on every binding, and Mote's polygon-only zones (what segment-map
emits) had none. Fixed on Mote's side — the spec is right, since a binding is
where a mission navigates to and a footprint alone cannot say. The pose is now
derived once on write rather than by every reader.

Three defects the new tests found, all fixed here:

• the agent's tracker looked a mission id up before expiring the retention
  window, so a mission the retention rule says was forgotten still answered as
  a duplicate;
• the wire fixture rejected an unknown capability before publishing
  dispatched, which the spec makes the only state rejected is reachable
  from;
• and, uncovered rather than introduced: a module-level pytest.importorskip
  raises Skipped, which derives from BaseException, and the launch_testing
  plugin this workspace loads imports test modules outside pytest's skip
  handling — so one such skip aborted collection of the entire
  mote_bringup/test directory and reported "no tests collected" with exit
  code 0. 412 tests were silently not running. Filed as a follow-up (#504)
  because nothing stops the next one.

Not done, deliberately

Broadcasting the vocabulary over the retained registry subtree — what makes a
second robot at a site cheap — is filed as #503. The split is its prerequisite
and is what this task was asked for; the broadcast is M6's own work and is
independently landable, which is how the three changes here were scoped.

Also left: wrong_floor and stale_revision remain unanswerable and are stated
as such — the robot holds one floor at a time, and the map bundle declares no
frame continuity, which zone/v0 puts out of its own scope too. running,
blocked and cancelled are optional in mission/v0 and Mote emits none of
them, which is conforming; mission/cancel is a reserved topic with no
publisher, because the task layer has no cancel and cancellable: true would
promise a message nothing handles.

A v1 robot and a v2 server do not interoperate. Nothing translates between
them, deliberately: a shim would be a third definition of the wire. Upgrade the
agent and the server together; identity and maps are unaffected, since neither
is on this tree.