Add Vietnam e-commerce compliance causal pack

[huygdv]

What changed

New compliance pack

• add packs/vn-ecommerce-compliance-2026
• 13 events, 18 causal links, 3 insight patterns, and 5 Canvas views
• connect legal instruments and effective dates to role-owned actions, operating controls, and evidence
• distinguish binding, derived-control, and recommended-practice nodes
• add Vietnamese/English labels and official-source provenance
• mark the pack as research-preview, asOf: 2026-07-30, and quality.causalProfile: policy-systemic

Generic pack → Canvas projection contract

• add optional manifest.json and views.json
• add executive, tax/accounting, e-commerce/livestream, IT/security, and teaching projections
• document canonical graph + disposable views in docs/PACK-VIEWS.md
• explicitly map the teaching view to the same pattern used by historical-causality lessons such as a WWI canvas: trigger → response → adaptation → observable outcome/evidence
• preserve backwards compatibility: older consumers can still load only events.json, links.json, and insights.json

Validation and scale guardrails

• extend scripts/validate-pack.mjs to validate optional manifests, view IDs, default views, highlighted paths, and all view-to-event references
• replace the World-Cup-specific global semantic gate with profile-aware quality rules
• declare sports-live for worldcup-2026 and policy-systemic for the compliance pack
• add an explicit, dated World Cup quality baseline for five pre-existing scorer-only summaries; only those exact known issues are downgraded, while new semantic debt still fails CI
• update add-match-day.mjs so cron updates use the pack's quality profile and baseline

Why

This PR tests a narrow but important Causari use case: turning regulatory change into an explainable causal path from source instrument to organizational adaptation and proof of execution.

The larger architectural goal is domain portability. World Cup, compliance, WWI teaching, AI-model recaps, and finance packs should share the same canonical graph contract while selecting different views and semantic quality profiles.

Safety and provenance

• official government or ministry sources are required for binding legal nodes
• operational interpretations are explicitly labelled as derived controls or recommended practices
• no penalty calculator or organization-specific legal conclusion is included
• the pack includes a legal/tax disclaimer and must be reviewed for organization-specific applicability

Validation

• validate-packs GitHub Actions run 54: success
• structural validation: 13 events, 18 links, 3 insights, 5 views; no dangling references
• semantic validation: policy-systemic profile passes
• sports-live profile remains active for World Cup-specific scoreline, entity, relationship-variety, and watchpoint checks
• branch is 15 commits ahead of main, 0 behind, and mergeable

Follow-up boundary

This PR ships the data contract and guardrails. A separate Canvas implementation should read manifest.json and views.json to provide:

1. view selector
2. timeline lanes
3. highlighted causal paths
4. source/evidence drawer
5. lecturer story mode
6. shared support for compliance and WWI-style teaching packs