package: write the ai.assets metadata contract so validate manifest passes on packaged output

[friedrichwilken]

Missing feature

validate manifest validates the ai.assets metadata contract (internal/workflow/metadata_contract.go), but only map (and the enforce sample) ever writes it. The manifest.json produced by package therefore always fails validate manifest with "no metadata contract found in annotations. Expected annotation: ai.assets" (#101).

Proposal

package already knows everything the model part of the contract needs (model name, artifact type, runtime, accelerator, resource requirements, MOF class after harden). Have it write an initial ai.assets annotation:

• package --model ... → ai.assets.model with name, version, type, runtime/accelerator requirements
• package --skill ... → ai.assets.skill (dependencies from --skill-refs)
• harden updates the MOF-related fields in the contract, not only the flat org.cncf.ai.model.mof.* annotations
• map keeps its role of adding relationships (model → skill → pipeline) to an existing contract instead of being the only producer

Acceptance: README Quick Test Drive (package → harden) followed by validate manifest --manifest ./test-model/manifest.json passes; an e2e test covers it.

Related: #101.