Add Belgian source-authoring prerequisites

[MaxGhenis]

Summary

• Add a publisher-backed Statbel NIS translation index for the 2025 Belgian municipal-merger vintage.
• Add a closed, typed v1 validator for deterministic offline publisher-artifact handoffs.
• Preserve and validate the existing R2, archive, replacement, checksum, and final-validation fields.
• Fail closed on duplicate NIS keys, unsafe URLs and paths, unknown fields, duplicate destinations, and any artifact/manifest overwrite collision.

This is prerequisite infrastructure for #69. It does not add the remaining Belgian publisher packages or claim that the six Microcosm selectors resolve, and it does not close #69.

Chronicle Governance

• Approved Chronicle agent role: ledger-source-ingestor
• Deterministic checks:
  • Belgian crosswalk and offline-manifest tests: 43 passed after the final fix
  • Source-package, source-cell, consumer-contract, and import regression set: 241 passed; one namespace-retirement test initially saw an ignored pre-rebase bytecode directory and passed in isolation after that cache was moved out of the worktree
  • Full-tree Ruff check: passed
  • Changed-file Ruff format check: passed
  • Import/load smoke and git diff --check: passed
• LLM judge verdicts:
  • ledger-source-fidelity: PASS — no fact values are introduced; the crosswalk rows remain publisher-backed identities and all existing manifest metadata is preserved.
  • ledger-contract: not required for this role; no consumer selection or model-binding contract is added.
  • ledger-boundary: PASS — reconciliation, aging, imputation, target activation, join selection, and solver construction remain outside Chronicle.

Tests

CI should run the clean-checkout full suite. The local full-suite attempt reached the unrelated deterministic bundle/database phase with no failures before the 21-minute cap.