Observe the ActivityPods providers instead of asking them what they do

The previous commit treated this package like the polyfill: a provider whose
source is off limits, with the unknowns raised as questions. That was the wrong
regime. The no-read rule attaches to a provider that publishes an engagement —
this one publishes nothing at all, and for that case the protocol has a bounded
reconstruction, made once at adoption time and pinned. So the two questions are
answered here rather than asked, and one of them turned out to be about the Pod
rather than about the providers, which is not our concern.

The observation is now the specification: contract_activitypods-providers,
stamped at the commit it was read from. A record's id is the resource URI and it
is the only identifier, so the seam's two collapse into one. update fetches,
merges and PUTs, so a partial write is safe and the seam declares this backend
as patching.

What the reading also surfaced matters more than either question. Every
container resolution runs against the session's own WebID — in getList, in
create, in a list subscription alike. So this backend can only ever show a user
their own records: no other user's event is reachable, and an event's
participant count cannot be computed from participations the app cannot read.
That is the product, not a detail, so it is need 1 rather than a friction, and
it is phrased as what it is: the capability sits one layer down, exposed as a
WebID parameter, just not reachable through the data provider.

Four frictions are recorded with the workarounds, including the auth provider's
timer and listener that construction installs and nothing removes — which the
runtime backend switch would accumulate, so the interval goes off and the app
checks status itself.

.project/contracts.yaml

@@ -7,18 +7,30 @@
 # separate interface, with its own folder inside `data-layer` — the concept that owns how
 # Festipod uses an external data surface.
 #
-# NO `consume:` SECTION YET, and that is a fact about the providers rather than an omission.
-# A `consume:` entry fetches a provider's published engagement; neither targeted backend
-# publishes one today. For `@activitypods/refine-providers` the only public specification is
-# a README, so the declaration beside it anchors on that repo's commit identity — resolved
-# with `git ls-remote`, which names a state without fetching any content. Add the entry the
-# moment an engagement exists to pull, or at adoption time through a bounded `reconstruct`.
+# `@activitypods/refine-providers` publishes NO engagement: no contract document, no stated
+# change policy, not even a git tag. So its entry is `type: reconstruct` — the one bounded
+# crossing this protocol allows, made once at adoption time: the leaf under `into:` is OUR
+# observation of that package, authored here and pinned to the commit it was read at. It is
+# not a promise anyone made us, and every upgrade has to re-observe it.
 #
-# The iron rule holds regardless: a gap in what a provider publishes is raised in the
-# `## Needs` of our declaration, never worked around by reading its source (see
-# `data-layer/rule_app-uses-sdk-surface-only` on the sibling branch, and AGENTS.md).
+# Once reconstructed, that leaf IS the specification this app codes against. Reading the
+# package's sources again at work time is not how a question gets answered — the leaf is
+# fixed or the gap goes into our declaration's `## Needs`.
 
 publish:
   # Key qualified by interface: a second declaration is coming for the NextGraph+polyfill
   # backend, and publish keys must stay unique.
   activitypods-providers--festipod: concepts/data-layer/activitypods-providers/usage_festipod.md
+
+consume:
+  - contract: activitypods-providers
+    into: concepts/data-layer/activitypods-providers/
+    type: reconstruct
+    # Canonical identity: the package's git remote plus the repo-relative folder the
+    # observation was made from. Per-developer access to a checkout of it lives in
+    # `.project/contracts.local.yaml`, which is never committed.
+    reconstructFrom: https://github.com/activitypods/refine-providers.git/src
+    # The branch the observation was read from. A tag would be the better pin, but this
+    # repository publishes none — the resolver turns this into the commit actually read,
+    # which is what `built_version` records.
+    ref: master