test: bootstrap sdk-consumer harness

[ORESoftware]

Changes

• add the generated sdk-consumer contract
• pin source repositories to immutable commits
• add submodule, Zed, and native-package lanes where declared
• add credential-free PR validation and gated integration workflow

Why

Create the specialized zed-pkg test surface for: consumer install; classpath wiring; offline frozen restore.

Impact

All declared source repositories resolved at bootstrap time.

Checks

• node scripts/validate-plan.mjs
• profile-specific checks are recorded in test-plan.json

[linear-code]

DEN-2084