chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

src/load-contracts.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Load the four immutable contract files in fixed order and write the
+# generated system prompt to /var/lib/mosaic/system-prompt.md.
+#
+# Order is normative: CONSTITUTION.md, STANDARDS.md, SOUL.md, USER.md.
+set -eu
+
+CONTRACT_DIR="${1:-/opt/mosaic/contracts}"
+OUT="${2:-/var/lib/mosaic/system-prompt.md}"
+
+FILES="CONSTITUTION.md STANDARDS.md SOUL.md USER.md"
+
+if [ ! -d "$CONTRACT_DIR" ]; then
+    echo "load-contracts: contract directory not found: $CONTRACT_DIR" >&2
+    exit 1
+fi
+
+PARENT="$(dirname "$OUT")"
+mkdir -p "$PARENT"
+
+TEMP="$OUT.partial"
+: > "$TEMP"
+
+for f in $FILES; do
+    path="$CONTRACT_DIR/$f"
+    if [ ! -r "$path" ]; then
+        echo "load-contracts: missing contract file: $path" >&2
+        rm -f "$TEMP"
+        exit 1
+    fi
+    printf '===== CONTRACT: %s =====\n' "$f" >> "$TEMP"
+    cat "$path" >> "$TEMP"
+    printf '\n' >> "$TEMP"
+done
+
+mv "$TEMP" "$OUT"
+echo "load-contracts: wrote $OUT from $CONTRACT_DIR" >&2