Define the stable native task type safety boundary

[RobLe3]

Summary

• define the finite stable task-session type allowlist
• fail closed on the unresolved 0x0B/0x0C registry collision before proportional allocation
• keep experimental relay sessions isolated and production native TCP at the qualify-or-exclude gate
• add canonical cross-SDK vectors and protect them in the fixture checker

Validation

• PATH=/tmp/iicp-protocol-ci-venv/bin:$PATH tools/run_profile_fixture_contract.sh
• native fixture copies validated byte-identically across Python, TypeScript and Rust
• release closure regenerated and verified (262 pinned artifacts)

Advances #5; it does not close the remaining TLS, lifecycle, CBOR and adversarial-vector criteria. No release or deployment is authorized.