Verified HCL presentation

UWS 1.13 adds the presentation/deprecation contract. Its wire fields and execution rules remain the UWS 1.12 rules. The separate github.com/OpenUdon/uws/hcl module owns deterministic Render, independent lossless Verify and deprecated Import. M08.2 implements the byte-based codec and the byte-pinned conformance supplement covers the complete existing typed corpus, exact numeric lexemes, strings/keys and refusal cases. The root/codec release passes M08 whole review 3; exact source, artifacts and standalone evidence are recorded in qualification.

The Go APIs accept Source{Format: JSON|YAML, Bytes: sourceBytes} and Options{Revision: exactCodecCommit}. Render returns View{HCL, Provenance} only after Verify independently reconstructs the complete source projection. Import(ctx, hclBytes) returns proposed JSON and remains deprecated. Codec revision is caller-supplied metadata; the consuming worker must bind it to the actual executable/module closure rather than trusting a producer claim.

Supply explicit JSON or YAML bytes and the exact codec revision. A successful view must carry source format/raw SHA-256, codec contract/revision and HCL SHA-256. Hash agreement alone is not a semantic proof. Verify must compare the complete source projection and required numeric lexemes without float64 or JCS equality. Large integers, precise decimals, exponents, signed zero, strings, dynamic keys, extensions, null/absence and empty containers must retain their meaning. An unsupported source or failed proof suppresses the entire view.

The HCL view is derived: it does not replace source bytes, become a package input, grant approval, or authorize execution. Label any historical digest-bound packaged workflow.hcl separately. Changed bytes or codec revision require fresh verification; conversion never transfers grants or reactivates a schedule.

Import is an explicit compatibility API for the inert supported HCL subset. Its JSON output is a proposal requiring the consuming product's validation and confirmation. It cannot load files/variables, invoke HCL functions, fetch URLs, resolve credentials or execute workflows. Existing root convert/uws1 HCL APIs and older inputs remain available throughout Stage 11; browser migration, input removal and transitive dependency extraction require later qualification.

Consuming workers own hard process CPU/RSS/deadline limits, mounts/network, cancellation, teardown and private-value filtering. This specification/module does not supply those controls or assert that UWS core is HCL-free. Source parsing, package trust, credentials and runtime authorization remain with their owners.