feat: add bounded RF signal-source domain

[Scaxlibur]

Summary

• Add the independent rf_source domain, configuration, descriptor contracts, service layer, CLI, run-plan operations, and artifacts.
• Add bounded safety-gated RF CW, output, AM/FM/PM modulation, modulated-output, Pulse, Pulse Output, Step Sweep, and read-only trigger-configuration contracts.
• Document DSG830 capability promotion boundaries and the controlled evidence model.

Validation

• .venv/bin/python -m pytest -q — 1988 passed, 1 skipped, 131 subtests passed
• .venv/bin/python -m ruff check .
• git diff --check origin/master...HEAD

Scope

This PR adds Core contracts and safety gates only. Model-specific production capability remains declared by the instrument plugin and its separate hardware evidence.