feat(dispatch): /dispatch structured-output handler + kata first-party plugin (kata-ai/v1)

[DojoGenesis]

Implements DGS-149 (scout Route B via D).

What's added

• POST /dispatch and POST /v1/dispatch, behind AuthMiddleware.
• A dispatch registry. Structured ops load from plugins/kata/skills/*/SKILL.md (kind: structured).
• Execution:
  • calls the provider directly with system = SKILL body and user = input JSON
  • one forced emit_result tool (tool_choice: required)
  • no system/RAG injection (X-Dojo-Injected: none)
  • validates against the output schema plus the contract shame-lint
  • returns {output, provenance{skill, skill_version, contract, model, request_id, generated_at}, usage}
• Error contract: 400 invalid_request/invalid_input/subject_mismatch, 404 unknown_skill, 422 unsupported_contract, 502 invalid_model_output (all with X-No-Retry), and 503 provider_unavailable (retriable).
• plugins/kata/: 13 prompts (bilingual, user input treated as data, memory off in v1). Names are added to reserved-names.txt.
• plugins/kata/contracts/kata-ai/v1 is vendored from DojoGenesis/kata (bde2add) with SOURCE and MANIFEST.sha256.
• Schema loader: pre-registers on-disk schemas by $id so local $ref resolves. No network fetch.
• New dependency: github.com/santhosh-tekuri/jsonschema/v6 v6.0.3.

Blocked: kata-memory-write and kata-account-delete are registered but return 501, because the memory store has no per-user scoping (DGS-163).

Tests: green across the root, server and integration modules. Includes a fixture eval (13 ops / 26 fixtures / 107 invalid cases), all-ops-load, a manifest check, no-injection assertions, and the 401/400/404/422/502/503 paths.

Not done:

• Never run against a real model.
• Not deployed. Merging to main does not deploy the prod gateway.
• Set KATA_DEFAULT_MODEL before deploying; otherwise resolveProvider falls back to the first provider.

Refs DGS-149, DGS-150

🤖 Generated with Claude Code