Specify the portable control-plane core

[yihanzhu]

Problem

The portable-control-plane-core intent is merged, but implementation cannot start until a complete G2 spec defines the contracts and safety boundaries. The spec must be usable by a plan author who did not see the earlier discussion.

Outcome

Add only work/portable-control-plane-core/spec.md. It must:

• define the strict v1 JSON document family and exact shared references;
• keep stage status separate from typed work outcome;
• bind evidence to the exact request, attempt, outputs, profile, environment, and performer;
• keep capability offers, profile requests, future grants, and actual use separate;
• preserve producer, verifier, reviewer, and publisher boundaries;
• define caller-selected deterministic profile resolution without claiming that an exact ref is trusted;
• prove contract substitution with four declarative fake adapter package trees;
• answer every open question in the merged intent;
• keep all live adapters and autonomous writes out of scope.

Gate

Merging the spec PR is G2 approval of the design. It does not approve a plan, the expected 520–780 line size exception, or implementation. The later high-risk plan must request those decisions before code.