feat(packaging): publish orro from the ORRO repo — rename to orro, declare witnessd dependency, retire the 'future work' invariant

[moonweave]

Reconciliation

• Makes the ORRO repository the canonical source of the already-published orro distribution.
• Renames the distribution from orro-product-wrapper to orro and advances the source version to 0.1.0 (PyPI 0.0.x is already live; publishing 0.1.0 remains a separate approved step).
• Declares witnessd>=2.3.2 in both package metadata surfaces; the clean install proof resolved witnessd 2.3.3 from PyPI.
• Keeps the orro_wrapper import package and both orro / orro-wrapper console scripts.
• Keeps subprocess delegation unchanged: DEFAULT_ENGINE_COMMAND remains the current Python running -m orro, and delegation still uses subprocess.run(...).
• Updates docs, contract checks, package plans, command-migration fixtures, distribution/install checks, and version-coherence fixtures from the stale future-work/no-dependency/skeleton identity to the published reality.
• Preserves the honesty boundary: the wrapper contains no engine, proofrun, proofcheck, verifier-truth, merge-approval, or assurance logic.
• Does not modify witnessd, Depone, or engine-lock/orro-e2e-engine-lock.json, and does not publish to PyPI.

Local ORRO CI verification

All commands were run with /usr/bin/python3 and exited 0:

• scripts/check_no_bidi_controls.py
• scripts/check_orro_repo_contract.py
• scripts/check_orro_language_boundaries.py
• scripts/check_orro_assurance_contract_fixtures.py
• scripts/check_orro_release_manifest.py
• scripts/check_orro_release_manifest.py --self-test
• scripts/check_compatibility_matrix.py --metadata-only
• scripts/check_compatibility_matrix.py --self-test
• scripts/check_orro_packaging_decision.py
• scripts/check_orro_fallback_policy.py
• scripts/check_orro_command_migration.py
• scripts/check_orro_command_migration_dry_run.py --json
• scripts/check_orro_command_migration_dry_run.py --self-test
• scripts/check_orro_wrapper.py
• scripts/check_orro_wrapper_install.py --json
• scripts/check_orro_wrapper_install.py --self-test
• scripts/check_orro_wrapper_distribution.py --json --allow-network
• scripts/check_orro_wrapper_distribution.py --self-test
• python3 -m py_compile over every CI-listed script, scripts/check_orro_version_coherence.py, and src/orro_wrapper/*.py
• scripts/check_no_bidi_controls.py --self-test
• scripts/orro_e2e_smoke.py --self-test
• scripts/update_orro_engine_lock.py --self-test
• scripts/bootstrap_orro.py --self-test
• git diff --check

Pinned-engine smoke

• Confirmed sibling witnessd remained at locked revision 5db87ac975452d9fed233306645e179b78087d68.
• Used a disposable /tmp checkout of locked Depone revision e1b020b8300c569e35f771c9f84f6998f99a86ce because this fresh workspace had no sibling Depone checkout.
• Ran the repository contract, e2e self-test, and full smoke with the committed engine lock and --allow-network for isolated build bootstrap.
• Result: decision=pass, engine_lock.matched=true, and wrapper_default_delegate_help_exit_zero=pass.

Clean-venv install proof

• python3 -m build produced orro-0.1.0.tar.gz and orro-0.1.0-py3-none-any.whl.
• A fresh venv installed the wheel and pulled witnessd-2.3.3 from PyPI; pip show witnessd reported Required-by: orro.
• orro flowplan --help delegated successfully with exit 0.
• orro boundary emitted the non-engine boundary JSON with package version 0.1.0 and delegates_to_witnessd_hosted_orro=true.
• orro some-bogus preserved current behavior: exit 2 with orro: unknown command 'some-bogus'.
• scripts/check_orro_version_coherence.py and its self-test passed inside the clean venv.