feat: harden work-record and SBOM client contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

config/work-record-types.yaml

@@ -0,0 +1,44 @@
+# Implementation snapshot of the Custodian work-record kind registry.
+# Canonical source:
+# the-custodian/canon/standards/work-record-types.yaml (version 0.1)
+version: "0.1"
+status: active
+kinds:
+  - kind: workplan
+    id_patterns:
+      - "^[A-Z]+-WP-[0-9]{4}$"
+    legacy_patterns:
+      - pattern: "^MASON-0001$"
+        source: ops-mason bootstrap workplan created before WP infix convention
+        grandfathered: true
+  - kind: task
+    id_patterns:
+      - "^[A-Z]+-WP-[0-9]{4}-T[0-9]{2,3}$"
+      - "^ADHOC-[0-9]{4}-[0-9]{2}-[0-9]{2}-T[0-9]{2}$"
+    legacy_patterns:
+      - pattern: "^[A-Z]+-WP-[0-9]{4}-T[0-9]$"
+        source: early single-digit task suffixes (pre task-block convention)
+        grandfathered: true
+      - pattern: "^[A-Z]+-WP-[0-9]{4}-LEGACY-T[0-9]{2}$"
+        source: archived-workplan legacy task renumbering
+        grandfathered: true
+      - pattern: "^MASON-0001-T[0-9]{2,3}$"
+        source: ops-mason bootstrap tasks created before WP infix convention
+        grandfathered: true
+  - kind: intake
+    id_patterns:
+      - "^[A-Z]+-IN-[0-9]{4}$"
+    legacy_patterns:
+      - pattern: "^AWQ-[0-9]{3}$"
+        source: binky-control AutopilotWorkQueue
+        grandfathered: true
+  - kind: decision
+    id_patterns:
+      - "^[A-Z]+-DEC-[0-9]{4}-[0-9]{3}$"
+    legacy_patterns:
+      - pattern: "^DEC-[0-9]{4}-[0-9]{3}$"
+        source: binky-control DecisionQueue
+        grandfathered: true
+identity_reconciliation:
+  repeated_same_id_same_uuid: duplicate_source_occurrence
+  repeated_same_id_different_uuid: identity_collision