feat(analyzer): add declarative lint rule contract - #310

Three required fixes before this matches #309:

• crates/wright-analyzer/src/declarative.rs / docs/specs/SPEC-309-extensible-lint-rules.md: external rule YAML currently requires evidence and default-severity, while #309 explicitly keeps evidence classification Wright/owner-backed and project severity outside rule definitions. Project config also exposes only warning/info, not the approved off/warn/error policy. Align the public rule/config contract with the Issue AC rather than freezing the conflicting surface in an accepted spec.
• crates/wright-analyzer/src/declarative.rs: the matcher implements positional args plus exact literal equality only. #309 requires direct </<=/>/>= comparisons and localized/canonical parameter names, with representative complex-rule validation. Implement and verify those approved capabilities before treating the grammar as stable.
• crates/wright-analyzer/src/declarative.rs::condition_values: scoped condition matching walks facts.actions() for the whole Workshop rule, so a scope: while/if matcher can be satisfied by sibling or unrelated nested conditions; the selected if branch condition is not scoped correctly either. Restrict condition candidates to the selected scope so unrelated conditions cannot produce findings.

crates/wright-analyzer/src/declarative.rs::resolve_parameter still does not satisfy the previous localized/canonical parameter-name finding. _locale is unused and resolution only compares against CatalogEntry::params; with the pinned workshop-rs contract those are canonical parameter labels, not locale-specific aliases. The updated spec also narrows this to "canonical catalog labels", which conflicts with #309 rather than implementing its document-locale requirement. The new test only covers English duration, with no non-en-US/representative complex parameter case. Resolve parameter spellings through owner-backed locale data (adding the missing workshop-rs contract first if necessary) and verify canonical plus localized parameter authoring before treating the grammar as accepted.

Cargo.toml: the locale fix now correctly consumes an owner API, but it pins an unreleased commit from open workshop-rs#176 as a second workshop-rs dependency alongside =0.1.18. This skips the required owner -> contract/tests -> release -> consumer integration sequence and leaves Wright coupled to a transient post-v0.3.4 commit. Merge/release the owner capability first, then consume the released workshop-rs version here as the normal dependency rather than a parallel git-pinned catalog crate.

LGTM