Harden generated artefact ownership boundaries and transient ignore rules

[Copilot]

This PR clarifies ownership boundaries for generated artefacts so shard data, pack manifests, provider-op enrichment, and demo screenshots are treated as pipeline-managed outputs rather than hand-edited files. It also tightens ignore behavior for local transient generation outputs while keeping generated-offline runtime assets committed.

• Scope + governance alignment

  • Updated .github/carl/current-pr-contract.md to reflect this task’s scope, forbidden changes, and ownership/validation boundaries for generated artefacts.

• Ignore policy hardening

  • Updated .gitignore to ignore transient local outputs from data/sweep pipelines (inventory zips, timestamped sweep CSV/WebM/GIF, provider-op sweep dumps).
  • Added explicit comments documenting generated-but-committed paths that must remain tracked and pipeline-owned.

• Contributor-facing ownership rules

  • Added a dedicated Generated Artefact Ownership (Do Not Hand-Edit) section in CONTRIBUTING.md.
  • Added a matching Generated Artefact Ownership section in README.md to make pipeline ownership explicit in top-level project docs.

# Generated but committed (pipeline-owned): do NOT ignore these paths.
# - extension/data/shards/
# - extension/data/manifest.json
# - extension/data/azure-provider-ops.json
# - demos/apispy-*.png