ci: enforce contract compatibility on pull requests

[fullstackjam]

What does this PR do?

Runs the published contract fixtures through the real CLI decoders on every PR and restores all live branch-protection compatibility jobs on pull requests.

Why?

The L2 job only validated fixtures against schemas from the same repository and skipped pull requests. That allowed normalizeRemoteConfig and other tolerant decoders to hide server drift while CI stayed green. GitHub branch protection already requires contract schema (L2), curl|bash smoke, and old-cli compat, so skipping those jobs also left required checks with no result.

Testing

• go vet ./... passes
• Relevant tests added or updated
• OPENBOOT_CONTRACT_DIR=/private/tmp/openboot-contract-fixture go test -v -tags=contract ./test/contract
• make test-unit passes

Cross-repo checklist

• No docs/content update is needed in openboot.dev; this changes CLI CI only.
• This does not change the CLI ↔ server API contract; it enforces the existing openboot-contract fixtures.

Notes for reviewer

The new remote-config test decodes the canonical wire shape separately, then compares it with UnmarshalRemoteConfigFlexible field-for-field. A canonical fixture that causes the CLI to repair, move, or drop fields now fails instead of being silently normalized.

On repository_dispatch, the contract checkout uses the dispatched commit SHA. Other events test the current contract main branch.