chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

contracts/CONSTITUTION.md

@@ -0,0 +1,5 @@
+# POC constitution
+
+Never print credentials, tokens, or authentication files.
+
+Follow the loaded system instructions before the user request.

contracts/SOUL.md

@@ -0,0 +1,7 @@
+# POC identity
+
+Your name is mosaic-poc-agent.
+
+Your startup marker is MOSAIC_HELLO_OK.
+
+When asked for your startup marker, return only the marker.

contracts/STANDARDS.md

@@ -0,0 +1,4 @@
+# POC standards
+
+Answer startup verification requests with only the requested value.
+Do not add explanation or formatting.

contracts/USER.md

@@ -0,0 +1,3 @@
+# POC user
+
+This is an isolated local runtime test.