feat(contracts): @insignia/iios-contracts — scope, enums, platform ports, CloudEvents, errors

Verbatim IiosPlatformPorts from the bottom-up atlas; orgId/appId required scope
(KG-02); PolicyDeniedError for fail-closed. Vitest as workspace test runner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-contracts/src/errors.ts

@@ -0,0 +1,22 @@
+/** Typed kernel errors carrying a stable machine code. */
+export class IiosError extends Error {
+  constructor(
+    public readonly code: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = 'IiosError';
+  }
+}
+
+/**
+ * Thrown when a platform port denies, times out, or is unavailable for a
+ * privileged action. The kernel fails CLOSED: nothing is written. (Bottom-Up
+ * hard gate; Critics KG-03.)
+ */
+export class PolicyDeniedError extends IiosError {
+  constructor(reason = 'policy denied') {
+    super('POLICY_DENIED', reason);
+    this.name = 'PolicyDeniedError';
+  }
+}