Enforce owner/namespace/scope field shapes per spec 006

[enricopiovesan]

Summary

Strengthens scripts/ci/capability_validation.py to enforce the field shapes specs/006-public-scope-and-identity finalizes:

• owner must be an object with a non-empty team string (contract.invalid_owner, spec 006 FR-003)
• namespace must be a non-empty string (contract.invalid_namespace, spec 006 FR-002), in addition to the existing path-mismatch check
• a published contract.json must NOT contain a top-level scope field (contract.forbidden_scope_field, spec 006 FR-004 — resolution tier is a consumer-side concept)

Adds scripts/ci/tests/test_capability_validation.py (stdlib unittest, no new dependency) and wires it into the capability-validation CI job.

Governing Spec

• 006-public-scope-and-identity (approved, v1.0.0) — FR-002, FR-003, FR-004

Project Item

• Closes Strengthen owner/namespace/scope validation per spec 006 #22 (Project 3, In Progress)

Definition of Done

• Rejects owner missing, non-object, or lacking a non-empty team string, with a field-specific stable error code
• Rejects any contract containing a top-level scope field, with an error message pointing to spec 006 FR-004
• Rejects empty/non-string namespace (path-segment mismatch already covered)
• Existing checks and error codes unchanged (additive only)
• Tests cover each new rejection and the passing case

Validation

• python3 -m unittest scripts/ci/tests/test_capability_validation.py -v — 9/9 pass locally (re-run after rebase onto latest main)
• python3 scripts/ci/capability_validation.py against the current capabilities/ tree — zero regressions