fix(patterns): reject future review provenance

[stacknil]

Summary

• reject pattern-card last_reviewed dates later than the current date
• add five stdlib unittest contracts for provenance, promotion, path identity, and placeholder decisions
• run the contract suite in pre-commit and GitHub CI
• document the new local check and review-date boundary

Design decision

Use a small policy-oriented unittest matrix rather than enumerating Markdown syntax. The tests exercise existing public validator functions with isolated temporary repositories and add no dependency.

Main risk

The future-date rule uses the runner calendar date. It intentionally rejects impossible provenance claims but does not introduce a freshness or expiration SLA for historical reviews.

Compatibility impact

Existing cards remain valid. A card with a future last_reviewed value now fails local and remote validation with a stable error.

Rollback path

Revert the documentation commit, the test/CI commit, and then the behavior commit. No persisted data or schema migration is involved.

Verification

• demonstrated red: 4 tests passed and the future-date contract failed on main
• python -m unittest discover -s tests -p 'test_*.py': 5 passed after the fix
• current pattern library: 8 stable patterns from 10 supporting notes across 13 cards
• frontmatter/taxonomy and placeholders: 157 notes passed
• changed-file pre-commit, markdownlint, yamllint, compileall, pip check, and git diff --check passed
• privacy scan: no local-path or identity-bearing material

Fixes #3

[stacknil]

Post-CI diff review complete.

• Design decision: reject future review provenance at parse time and pin five policy decisions with dependency-free unittest fixtures.
• Main risk: date.today follows the validation runner calendar. The rule rejects impossible future claims but deliberately does not define a review-expiration SLA.
• Compatibility impact: all current cards and 157 public notes remain valid. Only future last_reviewed values become invalid.
• Rollback path: revert the documentation commit, test/CI commit, and behavior commit in that order; no schema or persisted-data migration is involved.

Evidence: local and remote heads match; the PR contains 7 files and the required behavior, tests, and docs commits; git diff --check and privacy scanning pass; two workflow runs are green; and the GitHub job log confirms the new validator-contract test step completed successfully. No reviewer or bot concerns are outstanding.