No exceptions: remove the registry: true provability exemption — 500 exempt, but 434 already prove something #2557

Policy decision (operator, 2026-08-21): no exceptions. registry: true stops excusing
a contract from proving anything.

The mechanism being removed

crates/aprender-contracts/src/schema/types.rs:

if self.metadata.registry && self.metadata.kind == ContractKind::Kernel { /* exempt */ }
...
self.kind() == ContractKind::Kernel   // provability applies ONLY to Kernel

Kernel is #[default]. So a contract can self-exempt by setting one boolean, and any
non-Kernel kind escapes the obligation entirely. Both roads end at a contract that
proves nothing, and the flag is self-issued, silent, undated, unowned, uncounted and
unbounded — which is why it accumulated.

Blast radius — MEASURED, and much smaller than it looks

contracts total                                   1220
  registry: true (currently exempt)                500
    of those, ALREADY have falsification structure 434   <-- 87%
    of those, have NOTHING at all                   66

434 of the 500 already do the work and are exempting themselves needlessly. Removing
the exemption mostly just starts counting what already exists. The genuine debt is
66 contracts, not 500.

This inverts the usual objection. The exemption was never load-bearing for the corpus;
it was load-bearing for 5% of it.

Work

1. Remove the exemption from provability_violations(). Provability applies on the
   merits, not on a self-declared flag.
2. Land the 434 as counted — expect proven to jump and several ratchets to move.
3. Triage the 66: prove, or delete. A contract that asserts nothing and is exempt from
   asserting anything is not a contract, it is a comment in YAML.
4. Delete the registry field once nothing reads it, so it cannot come back.

Mutation requirement

Removing an exemption is exactly the change that can look successful and do nothing.
Prove it in both directions:

• take one of the 66, run pv validate → must now go RED
• restore the exemption → must go GREEN again
• confirm the mutation ENGAGED (a sed that fails to match reads identically to "the
  guard is fine")

Why now

This blocks the competitive-parity mandate (#2556): there is currently no way to write
a contract that must prove something, because Kernel can self-exempt and non-Kernel
carries no obligation. Every enforcement design proposed this week died on it — three
independent adversarial reviewers returned NOT SOUND on the same point.

Refs #2556