feat(go): add go-jose contracts

[matiasdaloia]

Parent: #50

Depends on

• feat(go): add parser return sources #65
• feat(go): wire contract resolver and KB plumbing #75

Working unit

Author Go callgraph contracts for go-jose, paired with existing rules.

Scope

• Inventory current detection-rule Go APIs for go-jose.
• Add one schema-v2 YAML file or a clearly scoped set of YAML files under internal/callgraph/contracts/go/.
• Record each API disposition in the PR body.
• Add focused embedded-KB assertions.

Out of scope

• No parser or resolver infrastructure changes.
• No unrelated Go libraries.

Acceptance criteria

• feat(go): add parser return sources #65 and Go resolver/plumbing issue are merged.
• Every current rule API in scope has a disposition.
• go test ./internal/callgraph/contracts/... passes.

Dependency-intelligence contract acceptance

This issue owns library semantics. Shared export behavior is covered by #116 and #117.

Where the library API exposes the corresponding semantics:

• Classify lifecycle methods with the contract-native roles factory, config, operation, and output (config represents configuration).
• Record parameter roles and supported derivations for arguments that select an operation or contribute crypto metadata.
• Resolve interface, trait, or inherited lifecycle roles to concrete callable identities where the language supports it.
• Add focused embedded-KB assertions for every authored lifecycle role and parameter derivation.
• Keep parameter-condition syntax in detection rules; do not add forward-call or runtime-provider routing fields to contract YAML.