Validate emitted AEP records against canonical wasmagent-protocol schema

[telleroutlook]

Why this issue exists

The Agent Evidence Protocol (AEP) and compliance schemas were originally authored in wasmagent-js and independently copied into trace-pipeline. Those copies drifted: 5 shared schemas differed (150-450 lines apart), one had a copy-paste title bug (task-spec titled ConstraintCategory), and the same logical schema carried two conflicting $id URLs (wasmagent.dev/... vs github.com/.../blob/main/...). Drift in a shared contract silently breaks cross-repo evidence validation — the exact failure WasmAgent exists to prevent.

These schemas are now consolidated into a single canonical source: WasmAgent/wasmagent-protocol, published as @wasmagent/protocol (npm) and wasmagent-protocol (PyPI). Per the org repository boundary policy: one public schema has exactly one canonical source.

Action for wasmagent-proxy

The Rust aep-core types that emit AEP records must stay in sync with the canonical aep-record schema.

• Add a CI check that validates emitted AEP records against https://wasmagent.dev/schemas/aep/aep-record.schema.json (vendored from the wasmagent-protocol release artifact, or fetched pinned by version — not hand-copied and edited).
• Where the Rust structs duplicate the schema shape, generate them from / test them against the canonical schema rather than maintaining a parallel definition.
• Document the AEP schema_version this proxy emits and keep it within the range the canonical schema declares (aep/v0.1, aep/v0.2).

Future behavior rules (applies from now on)

1. Never copy a shared schema JSON into this repo. Cross-repo contracts (AEP records, the constraint/repair/task-spec/compliance family, rollout-wire) live only in wasmagent-protocol.
2. Consume schemas via the published package, pinned to a semver range. Do not vendor, inline, or fetch-at-build the raw JSON.
3. Need a schema change? Open it against wasmagent-protocol following CONTRACT-CHANGE-PROCESS.md. Additive changes are a minor bump; breaking changes require a major bump, a new schema version, an RFC, and a release-ledger announcement before merge.
4. Repo-private schemas stay here. Schemas only this repo consumes (e.g. output formats owned solely by this project) are NOT in scope for wasmagent-protocol and should remain local.
5. Blocked by publish: this work can land only after wasmagent-protocol@0.1.0 is published to npm/PyPI (tracked in [milestone Milestone 1 ] Publish @wasmagent/protocol@0.1.0 to npm and wasmagent-protocol==0.1.0 wasmagent-protocol#1). Until then, treat this issue as queued/blocked.

Note: this repo is discuss_only for the bot; implementation is by the maintainers. This issue is the detailed spec.