feat: Phase I I9 public API policy stub

[cschanhniem]

Summary

• Adds PAS- public API policy stub schema (src/openamp_foundry/interop/public_api_policy_stub.py)
• Machine-readable safety/privacy policy declaration for any future public API — write requirements first, implement later
• REQUIRED_NOT_COLLECTED forces explicit declaration that raw_sequence_data and candidate_ids are never collected
• sequence_data_accepted=False is always enforced — public API can never accept raw sequences
• 54 tests; BASELINE updated 11138→11192; I9 marked complete in NEXT_100_PR_MAP.md

Design

• VALID_AUTH_METHODS: api_key / oauth2 / none
• VALID_DATA_COLLECTION_CATEGORIES: 10-value controlled vocabulary
• REQUIRED_NOT_COLLECTED: (raw_sequence_data, candidate_ids) — must appear in data_not_collected
• Rate limits: 1–1000 rpm; rpd must be ≥ rpm
• required_not_collected_declared auto-computed from data_not_collected
• data_collected and data_not_collected may not overlap

Safety

• Makes privacy and rate-limit requirements testable before any API is written
• Sequence data is explicitly blocked at the schema level
• Does not weaken any existing safeguard

Test plan

• 54 unit tests pass (constants, build, validate, format)
• BASELINE regression test passes (11192)