Add real-application processing and provider conformance contracts

[TheRealBecks]

Closes #110

Summary:

• add immutable Nextcloud and Forgejo application fixtures with independent native semantic assertions
• retain reproducible Docker Compose config evidence separately from bounded Podman runtime observations
• fix preservation of unquoted required interpolation expressions and add direct recovery regressions
• gate the application contracts in local, pull-request, and release validation

Validation:

• ./scripts/check-all.sh --check (27/27 steps passed)
• cargo ci-application (9/9 tests passed)
• cargo ci-policy (35/35 tests passed)