docs/tooling: add npm test, centralize strict JSON loading, add CONTRIBUTING, remove vestigial tsconfig

[GsCommand]

Motivation

• Improve first-touch contributor experience by adding a standard npm test entry and a concise contributor guide.
• Reduce documentation and tooling duplication by making the README the canonical validation command surface and removing repeated command blocks across other docs.
• Make JSON validation and integrity checks feel deliberate by centralizing strict JSON loading and removing ad-hoc duplicate-key detection code.

Description

• Added test script in package.json that delegates to the repo validation aggregate by running npm run validate, and included CONTRIBUTING.md in the published files list.
• Introduced CONTRIBUTING.md with focused contributor workflow, PR expectations, commit convention, required pre-merge validation commands, and guidance when changing schemas/examples/docs.
• Canonicalized strict JSON loading by removing inline assertNoDuplicateObjectKeys implementations and switching scripts/validate-all.mjs and scripts/validate-examples.mjs to use loadJsonStrict from scripts/load-json-strict.mjs.
• Removed vestigial tsconfig.json and updated docs to clearly state there is no current-line TypeScript compile target while labeling legacy v1.0.0 TS examples as compatibility artifacts.
• Updated documentation examples to prefer the explicit ESM-friendly import @commandlayer/commercial/schemas/v1.1.0/index.json, made README.md the canonical validation command surface, reduced duplicated command blocks across INTEGRATOR.md, ONBOARDING.md, SECURITY.md, and SPEC.md, and added brief schema-browsing guidance for the flat self-contained architecture.

Files changed: package.json, CONTRIBUTING.md (new), README.md, INTEGRATOR.md, ONBOARDING.md, SECURITY.md, SPEC.md, scripts/validate-all.mjs, scripts/validate-examples.mjs, and deletion of tsconfig.json.

Exact decisions made: npm test maps to npm run validate; strict JSON loading is centralized to loadJsonStrict; duplicate-key helper code was removed from validation scripts; docs use explicit JSON path imports by default; README.md is the canonical command list; v1.0.0 remains a retained legacy line and is documented as not receiving the same automated validation guarantees.

Intentionally left unchanged: repository schema contracts and semantics were not modified; scripts/load-json-strict.mjs itself was not changed since it already implements the canonical strict loader; no CI coverage for v1.0.0 was added because the repo policy treats it as retained legacy rather than an actively supported current line.

Testing

• Ran npm test which executes the full validation aggregate and it completed successfully.
• Ran the validation stages individually (npm run validate:schemas, npm run validate:examples, npm run validate:integrity) and each stage succeeded.
• Verified integrity with sha256sum -c checksums.txt and all checksum entries passed.

---

Codex Task