Publish PKIMM generic assessment profile and release contract

[vanbroup]

Summary

This PR completes the PKIMM repository side of the multi-model self-assessment integration. PKIMM remains the canonical owner of its normative model and now also owns the separately versioned declarative profile that tells the shared assessment runtime how to present and score that model.

The change does not alter PKIMM 2.0.0 model content, generated category pages, identifiers, weights, or score results. It removes the architectural need for a PKIMM-specific runtime branch: the shared tool implements registered experiences and scoring strategies, while this repository selects weighted-maturity and weighted-average through data.

Related integration work:

• Shared assessment runtime and PQCMM support: Generalize assessment runtime and add PQCMM workflow self-assessment#169
• PKI Consortium website and release-driven PQCMM pages: Publish PQCMM assessment and release-driven model pages pkic.org#730

What changes

• Adds the canonical PKIMM self-assessment profile for model 2.0.0.
• Adds the hardened shared assessment-profile JSON Schema used by the generic runtime.
• Keeps subject terminology, weighted scoring parameters, assurance states, report policy, and PAdES field policy in profile data rather than application code.
• Adds a focused compatibility validator for model references, generic methodology parameters, weights, subject rules, browser assurance boundaries, attestation signing policy, and unique signature fields.
• Adds positive and negative tests covering valid compatibility and rejection of version drift, model-specific scoring, negative weights, browser verification claims, and duplicate PDF signature fields.
• Extends CI to validate archived/current model schemas, the references schema, generated documentation, and the assessment profile.
• Adds a reusable validation workflow and a release workflow that publishes pinned model, profile, schema, and reference assets through the GitHub Release API with SHA-256 checksums and deterministic source archives.
• Documents the model/profile responsibility boundary and release-consumption path.

Architecture and compatibility

The dependency direction is:

1. PKIMM model YAML defines normative modules, categories, levels, requirements, and weights.
2. The PKIMM assessment profile selects generic runtime behavior and report policy.
3. The shared self-assessment tool parses the model/profile contracts and dispatches registered generic methodology implementations.
4. Downstream builds can consume pinned GitHub release assets instead of maintaining another independently authored PKIMM profile.

The added model YAML, profile YAML, and schema are byte-identical to the copies exercised by the shared runtime branch. Existing PKIMM scoring remains the weighted average of assessed, applicable categories with the configured final rounding. Not Assessed and Not Applicable handling remains unchanged.

This PR does not change the current pkic.org PKIMM content submodule or website routes. It establishes the release assets needed for release-API consumers without coupling repository authoring to the assessment application.

Trust boundary

The browser exposes self-assessment only. Qualified third-party assessment and PKI Consortium certification remain external workflow states. The profile defines optional executive and security-executive PAdES fields and allows additional signatures, but actual signer identity, organization binding, authority, trusted time, and validation remain responsibilities of the external signing and review workflow.

Validation

• 20 Python tests passed, including positive and negative profile cases.
• PKIMM 1.0.0 and 2.0.0 model YAML passed their JSON Schemas.
• The references catalog passed its JSON Schema.
• Model/docs consistency passed with 0 errors and 0 warnings.
• Assessment profile compatibility validation passed for profile 1.0.0 and model 2.0.0.
• The shared runtime profile-security suite passed: 1 suite, 7 tests.
• git diff --check passed.

Release note

Merging this PR does not create or move a tag and does not publish a release. A later explicit 2.0.0 tag push will run the validation gate before the release workflow publishes the pinned assets.