Add ops-owned hq queue schema and validator

[roccho-dev]

Purpose

Move the queue contract ownership to ops while preserving compatibility with edits-generated queue rows.

Scope

• Define/host hq.modelCommitQueued.v1, hq.agentTaskQueued.v1, and hq.receipt.v1 schema in packages/hq-modeling-runtime.
• Add a validator that accepts valid queue/receipt rows and rejects malformed or authority-confusing rows.
• Add valid/invalid fixtures.
• Keep compatibility with the existing edits command output shape.

Done

• Valid model commit queue row passes.
• Valid agent task queue row passes.
• Valid receipt row passes.
• Invalid JSON, missing required fields, duplicate ids, and forbidden authority fields fail.
• Validator can be used by edits in later integration.

Scope-achievement declaration

This issue is complete only when all of the following are true:

• Purpose lineage: directly protects editor-to-queue correctness and enables downstream ops worker/projection/ui flow.
• Core/port/adapter: schema and validation logic are pure core; validator CLI/file reading is adapter; queue IO is a port.
• Pure/effect split: row validation and error classification are pure; reading files/stdin and writing reports are adapter-only.
• False-positive exclusion: valid queue/receipt rows from known edits fixtures must pass.
• False-negative exclusion: malformed rows, authority-confusing rows, duplicate/idempotency problems, missing target when required, and invalid kinds must fail.
• Authority boundary: validator never admits or accepts rows; it only classifies intent/evidence records.
• Repo cleanliness: validator must not import editor UX or UI rendering; it is runtime contract logic only.

Non-goals

• Do not implement worker processing.
• Do not admit rows into accepted ledger.
• Do not change Vim/hq UX.

Checks

• Queue validator pass/fail fixture checks.
• Known false-positive and false-negative fixture inventory is present.
• Existing ops checks pass.

Depends on

• Add hq modeling runtime package scaffold #39

Why this matters

This makes queue rows an ops-owned runtime contract instead of an editor-owned implementation detail.