feat: register the TechLog Studio contract contribution

Registers the TECH_LOG_STUDIO_SESSION SAME_ORIGIN_COOKIE auth profile and
declares the tech-log-studio-http-v1 contribution covering all 18 JSON
Studio operations (everything except the multipart uploadStudioAsset),
built from two shared builders (safeOperation/keyedOperation) so every
KEYED command gets IDEMPOTENCY_REPLAY recovery and a zero retry budget,
and every SAFE read gets a plain retry budget, without repeating the
declaration shape 18 times.

Rescopes the canonical package identity from "tech-log-studio-contract"
to "@tech-log/studio-contract" (generator, canonical-source.json,
contract-generation.test.ts) because the platform's contribution
composer requires an npm-scoped packageId; the unscoped form failed
composition. Updates the release-manifest test fixture, which hardcoded
an empty expected contract set, to derive its expected packages from the
real installed set now that TechLog is always installed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/contracts/rest-profiles.ts

@@ -70,6 +70,19 @@ export const REST_AUTH_PROFILES = Object.freeze({
     allowedCredentialHeaders: Object.freeze([]),
     requiredCredentialHeaders: Object.freeze([]),
   }),
+  /**
+   * TechLog Studio session profile. Canonical mandates a session cookie plus
+   * `X-CSRF-TOKEN` on every mutating Studio operation; the platform already
+   * has this combination first-class as `SAME_ORIGIN_COOKIE` credentials with
+   * an `x-csrf-token` credential header.
+   */
+  TECH_LOG_STUDIO_SESSION: Object.freeze({
+    authProfileId: "TECH_LOG_STUDIO_SESSION",
+    transport: "SAME_ORIGIN_COOKIE",
+    credentials: "include",
+    allowedCredentialHeaders: Object.freeze(["x-csrf-token"] as const),
+    requiredCredentialHeaders: Object.freeze(["x-csrf-token"] as const),
+  }),
 } satisfies Readonly<Record<string, RestAuthProfile>>);
 
 function isCredentialHeaderName(value: unknown): value is CredentialHeaderName {