Pin FlexAuthResourceManifest schema (resource-registration-v0)

Closes FLEX-WP-0005 T03. Shape pinned against the Markitect-side emitter
in markitect-tool/src/markitect_tool/policy/enterprise.py (FlexAuthResource
+ FlexAuthResourceManifest dataclasses, MKTT-WP-0014).

Artifacts:
- schemas/resource_manifest.schema.json (JSON Schema draft 2020-12)
- examples/markitect/resource_manifest.yaml (mirrors markitect-tool's
  example; metadata.flex_auth_contract = resource-registration-v0)
- pkg/api/resource_manifest.go (Go type with json + yaml tags, plus
  FlexAuthContractV0 const)
- pkg/api/resource_manifest_test.go (golden parse of the example +
  minimal-fields round-trip)

First external dep: gopkg.in/yaml.v3 v3.0.1. SBOM ingested into State Hub
(2 entries) — repo last_sbom_at now non-null. Makefile sbom target gains
a GOPATH/bin fallback so it works without ~/go/bin on PATH.

Interface change published to State Hub (a4a5293e-…) and inbox-notified
markitect-tool. The change is additive — Markitect's existing emitter
matches the pinned schema exactly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Makefile

@@ -33,11 +33,16 @@ lint:
 		go vet $(PKG); \
 	fi
 
+GOBIN_PATH := $(shell go env GOPATH)/bin
+
 sbom:
 	@mkdir -p $(BIN_DIR)
 	@if command -v cyclonedx-gomod >/dev/null 2>&1; then \
 		cyclonedx-gomod mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
 		echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod)"; \
+	elif [ -x "$(GOBIN_PATH)/cyclonedx-gomod" ]; then \
+		"$(GOBIN_PATH)/cyclonedx-gomod" mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
+		echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod via GOPATH)"; \
 	elif command -v syft >/dev/null 2>&1; then \
 		syft . -o cyclonedx-json=$(BIN_DIR)/sbom.cdx.json; \
 		echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (syft)"; \