Implement schema.json IO, validation, and default materialization

[0xLeif]

Part of 1.0 prep (private). From RFC docs/design/dynamic-schema.md.

• Load/validate/write <state-root>/schema.json (formatVersion 1)
• Materialize default demo-key schema when missing
• Path safety for FileState/EncryptedFile; Slice ref validation
• SpecSync deltas for schema file format

Depends on: #39 (RFC merged)
Blocks: key CLI + registry resolve

[0xLeif]

agent:cursor: implementing schema IO + registry + key CLI + schema projection (#62–#64) on branch cursor/issue-62-dynamic-schema-runtime

[0xLeif]

Implemented in PR #65 (branch cursor/issue-62-dynamic-schema-runtime). Releasing claim label.