feat(teams): publish installable contract review team pointer (#123)

## Why

The contract review team already has a reproducible public Git source,
but its market pointer is still listing-only and uses the legacy
display-only shape. The current DesireCore client contract requires
explicit members, capabilities, privacy, an immutable source ref, and
installability evidence.

## What changed

- publish the contract review team as an installable,
source-pointer-only team entry;
- add the six-member roster, capability boundaries, privacy notice, and
update date;
- record review and license evidence in the catalog sidecar;
- keep the legacy team-entry schema branch while adding the current
client contract, so existing public pointers remain valid during
migration.

The source remains a public HTTPS Git pointer locked to commit
`73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`. The team output is
supporting review material, not legal advice, and still requires
qualified human review.

## Validation

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — no errors; existing catalog
freshness warnings remain
- public-tree sensitive-pattern scan — zero matches

teams/contract-review-team/catalog-metadata.v1.json

@@ -40,7 +40,7 @@
   "timestamps": {
     "catalogUpdatedAt": {
       "state": "known",
-      "value": "2026-09-01",
+      "value": "2026-09-06",
       "precision": "day"
     },
     "releasePublishedAt": {
@@ -49,7 +49,9 @@
       "precision": "second"
     },
     "reviewedAt": {
-      "state": "unknown"
+      "state": "known",
+      "value": "2026-09-06",
+      "precision": "day"
     },
     "upstreamObservedAt": {
       "state": "known",
@@ -66,7 +68,7 @@
   },
   "governance": {
     "stewardship": "official",
-    "availability": "listing-only",
+    "availability": "installable",
     "license": {
       "state": "known",
       "value": "MIT",
@@ -77,6 +79,13 @@
       "name": "DesireCore Agent",
       "url": "https://github.com/desirecore-agent",
       "verified": true
+    },
+    "compliance": {
+      "licenseEvidencePath": "LICENSE",
+      "reviewedRef": "73cd87a9901cc548871927e9d5dbec8e4cc6c2b1",
+      "reviewedAt": "2026-09-06",
+      "reviewedBy": "DesireCore Agent",
+      "upstreamEndorsed": true
     }
   },
   "compatibility": {
@@ -86,16 +95,6 @@
     "requiredClientVersion": "10.0.137"
   },
   "spec": {
-    "kind": "team",
-    "supervisorName": "合同审查统筹官",
-    "supervisorAgentId": "contract-review-lead",
-    "memberCount": 6,
-    "memberNames": [
-      "合同输入治理官",
-      "条款结构化官",
-      "合同风险识别官",
-      "法域合规官",
-      "合同复核出报告官"
-    ]
+    "kind": "team"
   }
 }

teams/contract-review-team/entry.json

@@ -32,7 +32,6 @@
   "source": {
     "kind": "git",
     "repoUrl": "https://github.com/desirecore-agent/contract-review-team.git",
-    "repoBranch": "main",
     "ref": "73cd87a9901cc548871927e9d5dbec8e4cc6c2b1"
   },
   "requiredClientVersion": "10.0.137",
@@ -40,14 +39,55 @@
     "t": "合审",
     "bg": "linear-gradient(135deg, #5856D6, #3634A3)"
   },
-  "supervisorName": "合同审查统筹官",
-  "supervisorAgentId": "contract-review-lead",
-  "memberCount": 6,
-  "memberNames": [
-    "合同输入治理官",
-    "条款结构化官",
-    "合同风险识别官",
-    "法域合规官",
-    "合同复核出报告官"
-  ]
+  "shortDesc": "A six-member contract review team: intake gating, clause structuring, risk scanning and jurisdiction checks, closed by an independent reviewer who re-verifies against the source text before reporting",
+  "updatedAt": "2026-09-06",
+  "fullDesc": "A six-member contract review team: intake gating, clause structuring, risk scanning and jurisdiction checks, closed by an independent reviewer who re-verifies against the source text before reporting",
+  "members": [
+    {
+      "id": "contract-review-lead",
+      "name": "合同审查统筹官",
+      "role": "supervisor",
+      "version": "1.0.0"
+    },
+    {
+      "id": "contract-intake",
+      "name": "合同输入治理官",
+      "role": "member",
+      "version": "1.0.0"
+    },
+    {
+      "id": "clause-extractor",
+      "name": "条款结构化官",
+      "role": "member",
+      "version": "1.0.0"
+    },
+    {
+      "id": "risk-scanner",
+      "name": "合同风险识别官",
+      "role": "member",
+      "version": "1.0.0"
+    },
+    {
+      "id": "jurisdiction-auditor",
+      "name": "法域合规官",
+      "role": "member",
+      "version": "1.0.0"
+    },
+    {
+      "id": "review-reporter",
+      "name": "合同复核出报告官",
+      "role": "member",
+      "version": "1.0.0"
+    }
+  ],
+  "capabilities": [
+    "contract-review",
+    "input-governance",
+    "contract-structuring",
+    "risk-identification",
+    "jurisdiction-audit",
+    "independent-review",
+    "report-composition"
+  ],
+  "privacy": "合同正文与附件会发送到用户配置的模型服务进行辅助分析；团队不宣称离线处理或零外发。市场只分发公开 Git 指针，安装后产出必须由具备资质的法务或律师复核，不构成法律意见。"
 }