modules: specify the .kmod contract and the Store

[maxscharwath]

Epic for the modules domain. Spec: docs/spec/modules/README.md

The base build ships zero modules by design. This epic pins down the bundle contract, the registry trust model, lifecycle, and what a failing sidecar may do to the server.

How this epic works

Implementation and specification work hangs off this issue as sub-issues, so progress rolls up on the board without a hand-maintained checklist. Do not copy spec text into sub-issues — link to the section.

Done when

• Every section of docs/spec/modules/README.md carries a status other than DRAFT
• The must-answer list in that file is empty
• Behaviour that ships in this domain matches what the spec claims