Introduce PDR 0.3 with registry context and RFC 8785 hashing

[ILIASTEKEOGLOU]

Summary

PDR generation writes contract version 0.3. For the same input, document
hashes, record hashes and run_id differ from 0.2. Decisions do not change.

• Hashes use the RFC 8785 canonical form, so any RFC 8785 implementation
  can recompute them from the parsed document.
• registry_context (registry_id, registry_version, registry_hash)
  is recorded at document level and copied into each record.
  registry_hash is the RFC 8785 SHA-256 hash of the parsed
  qstriage/algorithm_registry.json data, so formatting changes do not
  affect it. The registry file is rejected if it has duplicate JSON keys.
• run_id is derived from source_hash, policy_pack_hash,
  registry_hash and pdr_version.
• observed_state adds scheme_type, components and
  validation_component. With the current registry they are single,
  [] and null; hybrid entries are added separately.
• Values outside the RFC 8785 range (for example integers above 2^53)
  stop pdr generate with exit code 1 and no output file.
• pdr verify applies the 0.2 rule to 0.2 documents and the 0.3 rule to
  0.3 documents. For 0.3 it also checks registry_context in every record.

Verification

• All hashes of generated 0.3 documents (inventory and CBOM input),
  including registry_hash, were recomputed with the independent
  rfc8785 0.1.4 package and matched.
• tests/fixtures/pdr_v0_2_sample.json, generated before this change,
  still verifies (27 of 27 checks), and tampering with it is detected.
• Relative to that fixture, only contract fields change: pdr_version,
  run_id, registry_context, hashes and the new observed_state
  fields. Decision, policy evaluation, evidence and mission content are
  identical.
• The 216 pinned classifications are unchanged; the snapshot file is not
  modified, and the three new fields are checked separately.
• A test binds registry_version "1" to its registry_hash. A content
  change without a new version fails the suite.
• Local run on Windows: 1403 passed, 1 skipped. A generated PDR passes
  32 of 32 checks; after changing one action_type value it fails with
  29 of 32.

Documentation

docs/pdr-contract.md (0.3 contract, registry context, scheme fields,
verification table), docs/usage.md,
docs/standards-and-classification.md,
docs/algorithm-identifier-grammar.md, CHANGELOG (Unreleased, Changed).
The README keeps its links to the v1.3.0 documentation and is updated
with the next release.