feat: register the TechLog Studio contract contribution

Registers the TECH_LOG_STUDIO_SESSION SAME_ORIGIN_COOKIE auth profile and
declares the tech-log-studio-http-v1 contribution covering all 18 JSON
Studio operations (everything except the multipart uploadStudioAsset),
built from two shared builders (safeOperation/keyedOperation) so every
KEYED command gets IDEMPOTENCY_REPLAY recovery and a zero retry budget,
and every SAFE read gets a plain retry budget, without repeating the
declaration shape 18 times.

Rescopes the canonical package identity from "tech-log-studio-contract"
to "@tech-log/studio-contract" (generator, canonical-source.json,
contract-generation.test.ts) because the platform's contribution
composer requires an npm-scoped packageId; the unscoped form failed
composition. Updates the release-manifest test fixture, which hardcoded
an empty expected contract set, to derive its expected packages from the
real installed set now that TechLog is always installed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/runtime-schema/http-schema.test.ts

@@ -9,6 +9,7 @@ import {
   composeRuntimeSchemaCodecs,
   validateWithRuntimeSchemaRegistry,
 } from "../../src/contracts/schema-registry.ts";
+import { INSTALLED_REST_AUTH_PROFILES } from "../../src/contracts/rest-profiles.ts";
 
 describe("HTTP platform schema boundary", () => {
   it("rejects an invalid top-level envelope", () => {
@@ -68,3 +69,20 @@ describe("runtime schema codec contribution", () => {
     ).toThrow("duplicate runtime schema codec");
   });
 });
+
+describe("REST auth profile registry", () => {
+  it("installs the TechLog Studio session auth profile", () => {
+    const profile = INSTALLED_REST_AUTH_PROFILES.get(
+      "TECH_LOG_STUDIO_SESSION",
+    );
+    expect(profile).toBeTruthy();
+    expect(profile?.transport).toBe("SAME_ORIGIN_COOKIE");
+    expect(profile?.credentials).toBe("include");
+    expect([...(profile?.requiredCredentialHeaders ?? [])]).toEqual([
+      "x-csrf-token",
+    ]);
+    expect([...(profile?.allowedCredentialHeaders ?? [])]).toEqual([
+      "x-csrf-token",
+    ]);
+  });
+});

tests/runtime-schema/release-manifest.test.ts

@@ -4,9 +4,22 @@ import {
   loadReleaseManifest,
   ReleaseManifestError,
 } from "../../src/bootstrap/load-release-manifest.ts";
-import { computeContractSetDigest } from "../../src/contracts/contract-set-canonical.ts";
+import {
+  computeContractSetDigest,
+  type ContractSetPackage,
+} from "../../src/contracts/contract-set-canonical.ts";
+import { EXPECTED_CONTRACT_SET_PACKAGES } from "../../src/features/installed-contract-contributions.ts";
 
 const EMPTY_SET_DIGEST = await computeContractSetDigest([]);
+/**
+ * TechLog's Studio contribution is always installed (Task 3), so the build's
+ * real expected contract set is no longer empty. A coherent manifest fixture
+ * must declare exactly what this build actually compiled in, or the boot-time
+ * `verifyContractSet` check rejects it as `CONTRACT_SET_PACKAGE_MISSING`.
+ */
+const EXPECTED_PACKAGES =
+  EXPECTED_CONTRACT_SET_PACKAGES as readonly ContractSetPackage[];
+const EXPECTED_SET_DIGEST = await computeContractSetDigest(EXPECTED_PACKAGES);
 
 const runtime: Parameters<typeof loadReleaseManifest>[0] = {
   build: {
@@ -49,8 +62,8 @@ const manifest = {
   routeChunks: { "route-home": "assets/home.js" },
   contractSet: {
     setAlgorithm: "CA_CONTRACT_SET_V1",
-    setDigest: EMPTY_SET_DIGEST,
-    packages: [],
+    setDigest: EXPECTED_SET_DIGEST,
+    packages: EXPECTED_PACKAGES,
   },
 };