feat(reporting-governance): add profile artifact binding slice

plugins/reporting-governance/test/governance-contract.integration.test.mjs

@@ -131,6 +131,36 @@ test('executeGovernanceContract stays compatible for legacy callers without prof
   assert.deepEqual(result.contract.package_actions, ['emit_event']);
 });
 
+test('legacy caller still fails once profile supplies compatibility envelope against mismatched descriptor', () => {
+  const brokenDescriptor = {
+    ...capabilityDescriptor,
+    compatibility: {
+      ...capabilityDescriptor.compatibility,
+      plugin_spec_versions: ['9.9.9'],
+      decision_schema: 'schemas/reporting-governance/not-the-canonical-decision.schema.json'
+    }
+  };
+
+  const result = executeGovernanceContract({
+    event: {
+      type: 'silence_timeout',
+      payload: { checkpoint_overdue: true }
+    },
+    capabilityDescriptor: brokenDescriptor,
+    policyPacks: [noSilencePack],
+    context: {
+      signals: ['checkpoint_overdue']
+    },
+    profile: strictProfile,
+    packageVersion: '0.1.0-mainline'
+  });
+
+  assert.equal(result.preflight.status, 'fail_closed');
+  assert.equal(result.contract.delivery_state, 'blocked');
+  assert.equal(result.contract.receipt_status, 'blocked');
+  assert.ok(result.planning.receipt.notes.some((note) => note.includes('schema mismatch: decision_schema')));
+});
+
 test('contract truthfully degrades when notify path can queue but cannot directly dispatch', () => {
   const limitedDescriptor = {
     ...capabilityDescriptor,