Enforce monotonic exact SemVer for the shared release-recovery contract

[rmcdaniel]

Problem

The shared release-recovery conformance runner validates the contract version as a SemVer-shaped string, but its change guard rejects only an unchanged version string. A changed contract can therefore lower the published version, move to an unrelated older line, or change only build metadata and still pass the guard that claims the version advanced. The validator also accepts numeric prerelease identifiers with leading zeroes, such as 1.0.1-rc.01, even though those are not valid SemVer 2.0.0 versions.

Because the contract and runner are synchronized across every release-recovery consumer, accepting a non-successor version weakens the common identity used to coordinate semantic changes.

Acceptance criteria

• Contract versions use exact SemVer 2.0.0 validation, including rejection of leading zeroes in numeric prerelease identifiers.
• When a previous contract exists and its content differs, the current version has strictly greater SemVer precedence. Equal precedence, downgrades, and build-metadata-only changes fail closed.
• First adoption remains supported when the previous commit genuinely has no contract, while an unreadable or unknown previous commit cannot silently disable the comparison.
• Focused vectors cover an unchanged version with changed content, patch/minor/major advancement, prerelease advancement, downgrade, build-metadata-only change, malformed numeric prerelease identifiers, and an unavailable previous commit.
• The corrected runner, contract identity, and digest pins are synchronized across every declared consumer and aggregate qualification proves the exact same version and digests on all target branches.

Delete when

Delete when no changed shared release-recovery contract can pass required qualification unless it carries a valid, strictly advancing SemVer version relative to the previous target-branch contract, and every declared consumer proves the same corrected contract and runner identity.

Required source targets

durable-workflow/.github@main
durable-workflow/cli@main
durable-workflow/sdk-php@main
durable-workflow/sdk-python@main
durable-workflow/sdk-rust@main
durable-workflow/server@main
durable-workflow/waterline@v2
durable-workflow/workflow@v2

[rmcdaniel]

Sequenced after #40 establishes one synchronized contract baseline across every declared target. The monotonic-version change must compare against that coherent baseline and land as one subsequent contract revision, rather than overlap the current propagation.