feat: start v2 milestone — Exchange (HEP-7) and Registry (HEP-8) layers

[siracusa5]

Summary

Opens the v2 milestone by promoting the Exchange and Registry design sketches into the normative specification through the HEP process. The defining property: v2 is additive, not a schema break — harness.yaml version stays "1", harness.schema.json's $id (/schema/v1/…) is frozen, and a v1 fragment is Exchange-compatible and Registry-indexable unmodified. The new layers get their own schemas under the /schema/v2/ $id namespace.

Both HEPs are Draft with the in-repo format prototype satisfied (schema + examples + eval + prose); runtime prototypes in harness-kit gate Accepted status.

Refs #16 (Exchange), #17 (Registry).

Changes

HEP-7 — Exchange (peer-to-peer 1:1 fragment sharing):

• heps/hep-0007-exchange-layer.md — Standards Track HEP; resolves the 6 open questions from the sketch.
• schema/draft/exchange.schema.json — the signed offer-envelope (ed25519 identity, optional X25519 encryption, oneOf plaintext/encrypted).
• protocol/exchange.md (+ docs mirror), examples/exchange/ (plaintext + encrypted), security/exchange.md (+ mirror), terminology, and eval/src/tests/schema/exchange.test.ts.

HEP-8 — Registry (hosted 1:many discovery):

• heps/hep-0008-registry-layer.md — Standards Track HEP; v2/v3 boundary kept verbatim.
• schema/draft/registry.schema.json — transparency-log entries + registration request/response shapes.
• protocol/registry.md (+ mirror), examples/registry/, security/registry.md (+ mirror), and eval/src/tests/schema/registry.test.ts.

Cross-cutting:

• security/crypto-map.md (+ mirror) — reconciles ed25519 (Exchange transit), SHA-256 (content/index integrity), and minisign (publisher signing, owned by integrity.md) as deliberately orthogonal primitives; registry-index signing deferred to v3.
• eval/src/lib/schema.ts — adds validateExchange / validateRegistry loaders.
• Framing: README / protocol/overview.md / getting-started layer tables → "draft (HEP-7/8)"; CHANGELOG.md [Unreleased] — v2; GOVERNANCE.md three-version model (milestone vs. layer vs. document-format).
• extensions/exchange.md + extensions/registry.md converted to promoted-pointer stubs (repo-root and website mirrors), keeping the dual-surface invariant.

Test Plan

• Local tests pass — cd eval && npx vitest run → 289 passed (36 new: 19 exchange + 17 registry), zero regressions.
• Both new schemas compile against JSON Schema 2020-12; all 6 example documents validate against them.
• Docs site builds — cd website && npm run build → 41 static pages, types valid, new spec/security pages wired into the sidebar.
• CI checks pass.

Notes

• This is one PR spanning two HEP bundles by request, intended to be squash-merged. The W0 framing changes touch both layers, which is why they aren't split.
• Issues Exchange layer: peer-to-peer harness fragment sharing (HEP-7) #16/Registry layer: hosted discovery for harnesses (HEP-8) #17 are referenced, not closed — the HEPs remain Draft and the issues continue to track them through Review → Accepted.
• No harness.yaml schema change; version: "1" and the v1 $id are untouched. website/public/schema/v2/ mirrors are intentionally not populated yet — that happens at release, not in draft.