feat(nlp-service): enforce versioned NLP result contract

[tom-sapletta-com]

Summary

• add a versioned NLPResultFields bundle with GBNF, Protobuf, JSON Schema, manifest, and fixtures
• send the schema through LiteLLM structured output and validate complete JSON before Pydantic/DSL mapping
• default the text boundary to openrouter/z-ai/glm-5.2 and identify every OpenRouter call with App headers
• declare the service's missing env2llm, dsl-contracts, dsl-validate, and jsonschema dependencies
• install unpublished workspace dependencies explicitly in the NLP Docker image

Validation

• nlp-service suite: 280 passed
• focused contract/enrichment tests: 13 passed
• changed-scope Ruff: passed
• Protobuf compiled with grpc_tools.protoc
• wheel contains all four v1 contract artifacts
• Docker image builds and imports app.main plus the packaged schema
• Diagit reports no OpenRouter App identity finding

The LLM produces NLPResult fields; WorkflowDSL remains deterministically runtime-owned. The separate enrichment response contract is intentionally a follow-up boundary.

[tom-sapletta-com]

Ponowne uruchomienie Examples Docker E2E nadal kończy się błędem w kroku Run examples Docker E2E (01–07), więc zmiana nie jest bezpieczna do scalenia. Dokładny HEAD został zachowany jako tag archive/2026-08-12/nlp-result-llm-contract (ebdc6e890d7f6a8daa5ca7a3ff2858d3a70c3974). Zamykam PR i usuwam tymczasową gałąź, aby repo wróciło do stanu tylko-main/zero-open-PR bez utraty danych.