feat(schemas): v0.1.0 meta-schemas + CI validation (#123, #124)

[zeevdr]

Closes #123. Closes #124.

Summary

Two single-file JSON Schema 2020-12 meta-schemas under `schemas/v0.1.0/`:

• `decree-schema.{yaml,json}` — validates the schema-definition format (`*.decree.schema.yaml`)
• `decree-config.{yaml,json}` — validates the tenant-side config format (`*.decree.config.yaml`)

Plus a Python validation harness (`scripts/validate-meta-schemas.py`) wired into CI as a new "Meta-schemas check" job, closing #124. The script asserts every checked-in canonical file passes the matching meta-schema and every fixture under `schemas/v0.1.0/testdata/invalid/` fails (proves the meta-schema actually rejects what it claims to). 17 invalid fixtures cover the full failure surface.

Departure from the schema-spec brief

The brief originally specified split-file YAML sources (OpenAPI-style: `field.yaml`, `constraints.yaml`, `info.yaml`, etc.) bundled to a single JSON artifact. The format proved small enough that splitting cost more than it saved — single-file with internal `$defs` is more idiomatic and easier to read. `schema-spec.md` updated to reflect.

What's covered

The schema meta-schema covers the full v0.1.0 reserved-key surface, including:

• All 8 field types (`integer`, `number`, `string`, `bool`, `time`, `duration`, `url`, `json`)
• Per-type constraint matrix via `allOf` of `if/then` branches over 4 type buckets (numeric / string / json / other) — better error messages than `oneOf` in ajv and python-jsonschema
• `dependentRequired:` and `validations:` keys (landed via Add dependentRequired: to schema spec v0.1.0 (parser + runtime enforcement) #193 and Reserve top-level validations: key in schema spec v0.1.0 (parser only, no engine) #192)
• `x-*` vendor extensions at every object level via `patternProperties`
• `unevaluatedProperties: false` at every object level (works correctly with `allOf` composition)
• `$schema` / `$id` / `format` permitted but not required

YAML→JSON

`scripts/yaml-to-json.py` is a 30-line Python script that converts the human-edited YAML sources to JSON. Both forms are committed alongside each other so consumers (schemastore.org, IDE language servers, CI validators) can `$ref` the JSON directly without a build step.

Test plan

• All canonical `.decree.schema.yaml` and `.decree.config.yaml` files in the repo pass.
• All 17 known-invalid fixtures fail with messages pointing at the offending path.
• `make validate-meta-schemas` runs the script locally.
• New CI "Meta-schemas check" job runs unconditionally (no `needs.changes` gate) so docs-only PRs still validate; included in the `CI check` aggregate gate.
• Legacy `schemas/schema-yaml.json` removed; `docs/concepts/schemas-and-fields.md` modeline updated to point at the new file.

Out of scope

• Publishing the JSON artifacts at `schemas.opendecree.io/schema/v0.1.0/decree-{schema,config}.json` (issue Publish meta-schema at schemas.opendecree.io #125).
• schemastore.org PR (issue Submit schemastore.org PR for editor integration #126).