feat(okf-v0.2): D4 — the Attested Computation contract, format only

Upstream §10 adds a concept type carrying a sanctioned way to compute a
value. This lands its FORMAT: the five contract fields for emission and
round-trip, and §10.2's one requirement. No execution — upstream defers
the receipt and verdict wire formats, so there is nothing to build a
runtime against.

Two additions, both additive:

- The five fields (`runtime`, `parameters`, `computation`, `executor`,
  `attester`) join `OKF_V0_2`'s emission order as one block, internally
  in §10.2's own listing order. Without it they still emit — in `emit`'s
  sorted tail, where `attester` precedes `runtime`, alphabetical order
  standing in for the contract's own. No bundle that carries none of the
  keys changes by a byte, and the v0.1 profiles gain nothing.

- `FrontmatterSchema.required_by_type` expresses "`runtime` is REQUIRED
  for this type and no other" — the first rule here keyed off a
  frontmatter VALUE rather than a key. It cannot be `required`, which
  would demand `runtime` of every document. A type the mapping does not
  name carries no extra requirement, which is what keeps it inside §14:
  a consumer must not reject on an unknown `type`, so a conditional
  keyed on an unknown type stays silent rather than guesses.

Also pinned, measured today: the line-oriented parser cannot read §10's
canonical BLOCK form. `executor` and `attester` both carry a `resource`,
and with no indentation model the second overwrites the first —
`executor.resource` is lost silently, no error. Characterized rather
than fixed: reading that form needs the structured reader (D1b), and a
half-reader that drops half a contract is worse than one that never
claimed to read it. CLAUDE.md gains the invariant that falls out of it:
we emit flow form, never block, or we write bundles we cannot read back.

578 tests, mypy --strict clean, goldens byte-identical.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KKKMwi7e7PVHoFW6dJK5XP

README.md

@@ -146,6 +146,31 @@ materialize_bundle(
 Omit the argument and no frontmatter block is written. Offering a key the
 profile does not name is refused before anything is written to disk.
 
+### Attested computations (v0.2 §10)
+
+`OKF_V0_2` supports the `Attested Computation` type as a **format**: its five
+contract fields — `runtime`, `parameters`, `computation`, `executor`,
+`attester` — are emitted in canonical position, judged, and round-tripped.
+`runtime` is required for that type and for no other, which the profile
+expresses through `FrontmatterSchema.required_by_type`; a type the mapping does
+not name carries no extra requirement, because §14 forbids a consumer to reject
+on an unknown `type`.
+
+Nothing here executes a computation or checks an attestation. Upstream defers
+the receipt and verdict wire formats, so there is no contract to implement, and
+the question an attestation answers — was this value produced the sanctioned
+way — is not this library's. It re-enters scope when upstream specifies the
+protocol.
+
+One limit worth knowing before you write such a concept: §10.2 presents
+`executor` and `attester` as nested block mappings, and this library's
+frontmatter parser is line-oriented. It reads inline **flow** mappings
+(`executor: { resource: …, receipt: [ … ] }`) as opaque values that round-trip
+unchanged, but it cannot read the block form — two block mappings that both
+carry a `resource` collapse into one namespace and the first is lost. Write the
+flow form; both are valid YAML, and a real YAML consumer recovers the same
+structure from either.
+
 ## Non-goals
 
 - Verdict/feedback machinery from the method specification (stays in the