feat(spec): define deterministic code constraints

[tcballard]

Summary

• define a versioned Code Constraints YAML block for decision artifacts
• standardize forbid_pattern, require_pattern, and forbid_import
• specify deterministic diff/full-tree enforcement and explicit coverage reporting
• forbid model-based or nondeterministic judges
• add a language-neutral JSON Schema and valid example

Validation

• jq empty schema/code-constraints.schema.json schema/artifact-specs.json examples/manifest.json
• git diff --check

Follow-up

The native Rust implementation will land separately in asdecided/core; the Sentry GitHub Action and façade packaging will follow in asdecided/ci.