Add shared cross-surface control overlay contract

[abrichr]

Outcome

Adds the canonical, cross-surface control-overlay contract to openadapt-types.
Desktop, hosted browser viewers, and evidence-media renderers can now share one
versioned vocabulary rather than evolving independent state models.

Contract

• openadapt.control-overlay-frame/v1
• openadapt.control-overlay-timeline/v1
• canonical phase, mode, profile, status, generic workflow-label, and terminal-state vocabulary
• deterministic state-ID builder plus validation
• exact evidence-pack ID and lowercase media SHA-256 binding
• ordered media offsets and source event/monotonic ordering
• immutable Pydantic models with unknown-field refusal
• packaged JSON Schemas with machine-readable vocabulary extensions for TypeScript and Rust consumers

The public frame has no free-form runtime text and rejects screenshots, action
targets, typed values, identities, URLs, logs, report bodies, user-authored
workflow names, and every other unknown field. Only synthetic or reviewed
sanitized_public timelines are admitted.

Validation

• 126 passed
• changed-file Ruff and formatting checks pass
• release-lock check passes
• exact-commit wheel and sdist build from the reviewed tree
• clean wheel import/build smoke passes
• wheel and sdist contain both versioned JSON Schemas, the MIT license, and no evidence corpus or private tuning

Exact local artifact SHA-256:

• wheel: 65c8986a95aa2a530d997a49a099700cb0071e7bdfcb404e21c407be4401505e
• sdist: 270c2462fa7a6d220c1c01327d22b08ba987c49e79504746f0be22b6b24b35ab

Consumer follow-up

This PR intentionally does not edit concurrent Desktop #61 or Cloud #151.
After release, each consumer should pin the exact openadapt-types version,
generate its TypeScript declarations/constants from the packaged JSON Schemas,
and retain only surface-specific rendering and transport code. Producers must
validate through ControlOverlayFrameV1 / ControlOverlayTimelineV1 before IPC
or evidence inventory; consumers must verify the manifest pack/media binding
before composition. The migration should delete the duplicated phase/status/
label/state-ID sources in each PR and add a generated-contract drift check.