[LAZARUS][SPEC] Define cell contract, roles, lifecycle, and publication rules
Addresses timmy-config#268.
- Establishes 6 core invariants (filesystem, credential, process, network, memory, audit)
- Defines 5 canonical roles: director, executor, observer, guest, substitute
- Documents full lifecycle state machine (IDLE -> INVITED -> PREPARING -> ACTIVE -> CHECKPOINTING/CLOSED/ARCHIVED)
- Specifies publication rules: what must, must not, and may be published back to Gitea
- Filesystem layout contract for process/venv/docker/remote backends
- Graveyard retention policy with hot/warm/cold tiers
Cross-references: #269 #270 #271 #272 #273 #274 #245
ee749e0b93