refactor(intrinsics): resolve the adapter's output contract from the adapter, not a parallel argument

[planetf1]

The problem, in plain terms

Mellea's adapter functions (LoRA/aLoRA capabilities like answerability
checking, hallucination detection, guardrails) each produce output in their
own JSON shape, and something has to check that shape before the caller trusts
it. Before this PR, which adapter actually ran and what shape its output
should be were decided in two unconnected places: the backend resolved the
adapter, then the high-level helper (check_answerability, guardian_check,
...) separately supplied a validator built from its own module-level constant.
Nothing enforced that the two matched. Passing the wrong validator for the
adapter that actually ran was possible and silent — a caller could think it
was checking one capability's output shape while actually resolving another
capability's adapter, or vice versa.

The impact was concentrated on core.py's three helpers
(check_certainty, requirement_check, find_context_attributions):
check_certainty and find_context_attributions had no validation at all
(raw json.loads, so a malformed or schema-drifted response failed with a
bare KeyError/IndexError far from the cause), and requirement_check
carried its own hand-rolled copy of the score-range check that a second,
independent copy in mellea/stdlib/requirements/requirement.py also carried
— two places that had to be kept in sync by hand and weren't.

Where this sits in Epic #929

Epic #929 (Adapter Function Lifecycle) restructures how Mellea composes
adapters — an Adapter is Identity + IOContract + WeightsBinding,
where IOContract varies by capability and WeightsBinding varies by
deployment. Discussion #1486 agreed that split explicitly; #1516 is Phase 2's
work on the IOContract (capability) axis only. The WeightsBinding
(deployment) axis is deliberately untouched here — activation/apply_activation
code is not part of this PR, by design, per that discussion.

This PR blocks #1144 (Phase 4 — removing the shim adapter classes
IntrinsicAdapter/EmbeddedIntrinsicAdapter entirely), since that removal
needs the shims to already carry real contracts rather than the Phase 1
_ShimIOContract placeholder. It also blocks #1358. Fixes #1516 itself.

What changed

Commits 1–2: the core refactor

• mellea/backends/adapters/io_contracts.py (new): a single,
  capability-keyed registry of IOContract instances, keyed by the same
  catalog name passed to both call_intrinsic() and resolve_adapter(), and
  exported as mellea.backends.adapters.get_io_contract. Its exhaustiveness
  over the adapter-function catalog is enforced at import time (mirroring the
  existing duplicate-effective_capability check in catalog.py).
• call_intrinsic() no longer takes an io_contract= argument. It calls
  .io_contract.parse() on the adapter resolve_adapter() actually returns
  — the validator now travels with the adapter, so a mismatch between the two
  is no longer expressible.
• IntrinsicAdapter/EmbeddedIntrinsicAdapter (the shims
  resolve_adapter() constructs) now look up their contract in the registry
  instead of the _ShimIOContract placeholder, which is now unreachable
  everywhere and deleted.
• The ten pre-existing module-level Adapter constants in rag.py/guardian.py
  keep their identity and weights as before, but now read io_contract
  from the same registry instead of declaring their own instance.
• core.py's three helpers each gained a declared contract for the first
  time. requirement_check's hand-rolled score-range validation moved into
  _RequirementCheckContract; find_context_attributions reads its
  now-list-wrapped result via ["items"].

Commits 3–4: independent code review, then fixes

Before merging, I ran an independent 3-reviewer panel (exhaustive / pragmatic
/ pattern-matching perspectives) against the diff. Two reviewers
independently found, from different angles, that the PR's own "single source
of truth" claim was false for the one capability it had done the most work
on: requirement_check_to_bool() (mellea/stdlib/requirements/requirement.py)
— the other production consumer of requirement-check output, used by
ALoraRequirement — still hand-rolled the exact validation this PR had just
consolidated elsewhere, with a comment pointing at code the PR had deleted.
Fixed: it now delegates to get_io_contract("requirement-check").parse(...).

Also fixed from review:

• get_io_contract wasn't exported from mellea.backends.adapters.__init__,
  so the docs pipeline pruned its page and the AGENTS.md-mandated docstring
  quality gate never saw it, despite being the function the module's own
  docstring designates as the mandatory entry point. Now exported.
• Two newly-added Adapter constants in core.py
  (_UNCERTAINTY_ADAPTER, _CONTEXT_ATTRIBUTION_ADAPTER) were dead code —
  nothing referenced them once io_contract= was removed from call_intrinsic
  call sites. Deleted; kept _REQUIREMENT_CHECK_ADAPTER, which a test uses as
  a resolve_adapter() stub.
• No test asserted that the shim adapters actually carry the real registry
  contract rather than a placeholder — every other test would still pass if
  that wiring were reverted. Added one regression test per shim class;
  verified each fails against a reintroduced placeholder and passes against
  the real fix.
• A round of lower-severity suggestions and nits from all three reviewers:
  stale RST directives left over from an earlier docstring pass, a
  self-contradictory "not used in Phase 1; implemented in Phase 2" placeholder
  message inside the Phase-2 module itself, ambiguous file references in
  docstrings, a fallback-contract docstring that undersold what it actually
  guards against, and a non-GPU unit test exercising the recorded
  context-attribution model output against the real contract (its GPU-gated
  equivalent is xfail(strict=False) for unrelated non-determinism, so it
  gave no CI signal on schema drift).

Behaviour changes worth flagging

Both are validation additions, not regressions, but they change what a
caller catches:

• check_certainty previously returned a plain KeyError for a response
  missing certainty; it now raises AdapterSchemaMismatchError.
• requirement_check_to_bool() previously raised an undocumented
  AttributeError for non-object JSON input (e.g. a bare JSON array); it now
  raises the documented ValueError its contract's parse() raises for the
  same input.

Deliberately out of scope

Per the #1486 capability/deployment split: the ten pre-existing constants'
placeholder LocalFileBinding() weights, and the Adapter.__post_init__
identity/weights cross-check that was tried and backed out during #1454 —
both are deployment-axis concerns, noted as future work in _core.py.
Activation/apply_activation code is untouched throughout.

Verification against real weights

Ran the qualitative, GPU-gated suites against ibm-granite/granite-4.1-3b
(Apple Silicon MPS, cached weights) rather than relying on mocks alone —
covering all 13 catalogued adapter functions' contracts against real model
output:

• test/stdlib/components/intrinsic/test_core.py — 3 passed, 2 xfailed
  (pre-existing, tracked non-determinism in attribution count — not a schema
  failure; confirmed with --runxfail that the failure is a plain
  list-equality AssertionError, not AdapterSchemaMismatchError).
• test/stdlib/components/intrinsic/test_rag.py — 14/14 passed.
• test/stdlib/components/intrinsic/test_guardian.py — 6/6 passed.

Test plan

• test/backends/test_adapters/test_io_contracts.py (new) — registry
  completeness against known_intrinsic_names(), the permissive-about-keys
  fallback for names outside the catalog (e.g. CustomIntrinsicAdapter),
  _RequirementCheckContract's score-range validation, and the recorded
  context-attribution fixture parsed without a GPU.
• test/backends/test_adapters/test_shims.py — new: IntrinsicAdapter
  and EmbeddedIntrinsicAdapter carry the real registry contract, not a
  placeholder (verified to fail on a reintroduced placeholder, pass on the fix).
• Existing test_rag_contracts.py / test_guardian_io_contract.py —
  unchanged, still exercise the same contract objects (now sourced from the
  registry) directly.
• test_core_schema.py — rewritten to exercise the real
  call_intrinsic → IOContract.parse path against a stubbed
  resolve_adapter return value, since the validation it tests no longer
  lives in core.py.
• test_util_unit.py — new: call_intrinsic parses via the resolved
  adapter's io_contract, and no longer accepts an io_contract= kwarg.
• Existing test_requirement.py (requirement_check_to_bool) — every
  pre-existing case passes unchanged against the delegated implementation.
• uv run pytest -m "not qualitative" — full suite, 3800+ passed / 5
  failed (all in test_python_tool.py, pre-existing and unrelated — Docker
  isn't available in this environment).
• ruff format --check ., ruff check ., uv run mypy . — all clean.
• Docstring quality gate
  (tooling/docs-autogen/audit_coverage.py --quality --fail-on-quality --threshold 100)
  — 100% coverage, 0 issues.

Fixes #1516