feat(profile): §7 conformance build-out — credbridge, distribution.yaml, cron, manifest

Closes the largest set of PROFILE-DISTRIBUTION-PROTOCOL §7 readiness gaps
surfaced in the 2026-05-23 audit. Profile goes from 4/8 to expected 8/8
once skills/proton-tools/ is committed.

New files:

  credbridge.sh           Personal-assistant variant of the shared-core
                          credbridge pattern. Three credentials in scope:
                          google-workspace (Gmail/Calendar/Contacts),
                          proton-bridge (himalaya IMAP/SMTP), perplexity
                          (raw WebSearch). Plan B marketing platforms
                          explicitly OUT OF SCOPE per CLAUDE.md hard rule.

  validate_access.sh      Emits PASS/BLOCKED/FAIL JSON line per credential.
                          Sourceable from install.sh and standalone. Exit
                          code always 0; status is in the JSON.

  distribution.yaml       Native Hermes install contract (`hermes profile
                          install` reads this). Mirrors cmo/ceo pattern.
                          Documents personal/agnostic naming exception
                          per FRAMEWORK §6.1 — no org suffix because there
                          is exactly one principal.

  cron/steev-daily-briefing.json.template
                          06:30 daily briefing skeleton, ships disabled.
                          Aggregates calendar + flagged emails + due tasks
                          + carried items + brief news scan into a single
                          digest in JP's voice. NEVER auto-sends, NEVER
                          touches business comms (CEO → CMO surface).

manifest.yaml fully rewritten:

  - Added `contract: CONTRACT.md` pointer (was missing)
  - Added inline comment explaining intentional `org:` omission
  - Declared skills/proton-tools (on disk via JP's untracked WIP; declared
    here so manifest matches disk truth once JP commits it)
  - Added `lib:` block (credbridge.sh + validate_access.sh)
  - Added `expected_external_skills:` informational list (google-workspace,
    apple-*, obsidian, himalaya, imessage, perplexity) — these come from
    Hermes' global skills tree per CLAUDE.md "reuse existing core skills"
  - Added `optional_tools:` block (4 MCP servers: proton-calendar/-email/
    -contacts, perplexity)
  - Added `credentials:` block listing the 3 creds + resolution path
  - Promoted `cron:` from empty list to a single steev-daily-briefing
    entry (disabled_on_install: true)
  - Added `sovereignty:` block (qwen3.6-35b-a3b on DGX Spark)

CONTRACT.md frontmatter migrated from legacy `tier: S` to T1 per
FRONTMATTER-SPEC. Added required fields (name, last_reviewed,
description, depends_on).

skills/proton-tools/ left untracked — that's JP's WIP, not mine to
commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

distribution.yaml

@@ -0,0 +1,29 @@
+# Hermes profile distribution manifest — native Hermes install contract.
+# Used by `hermes profile install`. Distinct from manifest.yaml (our workspace
+# convention layered on top — see ../sot/03-PROTOCOLS/PROFILE-DISTRIBUTION-PROTOCOL.md).
+name: steev
+version: 1.0.0
+description: "Steev — JP's personal AI chief of staff. Daily briefing (calendar + flagged emails + due tasks + carried items + brief news scan), inbox triage, comms drafting in JP's voice (French/English bilingual), and business-task delegation to ceo-planb. Personal-flow manager — no Plan B marketing surface. Sovereign on qwen3.6-35b-a3b."
+hermes_requires: ">=0.14.0"
+author: "Svrnty / JP <mathias@openharbor.io>"
+license: "proprietary"
+
+# Steev is personal/agnostic per CORTEX-OS-FRAMEWORK §6.1 — no org suffix.
+# Profile name = `steev` (not `steev-<org>`) because there is exactly one
+# principal: JP. Cloning steev for another principal = rename in
+# distribution.yaml only; no other code changes.
+
+env_requires: []   # credentials provisioned via credctl at install/runtime, never in env
+
+distribution_owned:
+  - AGENT.md
+  - CONTRACT.md
+  - CLAUDE.md
+  - README.md
+  - manifest.yaml
+  - schema.sql
+  - install.sh
+  - credbridge.sh
+  - validate_access.sh
+  - skills/
+  - cron/