feat(spec): build out System layer and element schema model

Picture the whole framework, then pin the element-kind language layer.

System platform layer — rebuild the semantics likec4 can't draw (ADR-0001..0004):
- Prelude: opaque Identifiers carrier (ProjectId/RunId/SessionId/Principal)
- System/Run: RunState + Terminal subset (set completeness left OPEN, no invented pending)
- System/Lock: lock owner=run (typed), LockTable exclusivity, WellFormed invariant
  (a lock holder must be a non-terminal run — couples Lock and Run)
- System/Permission: read<edit<manage role lattice, capability derivation,
  can_mono monotonicity theorem; force-release sits outside the lattice (admin-only)
- System/Audit: intentionally thin (mostly plumbing, OPEN)

Courseware product layer — split the single Lesson file into focused modules and
fix doc tautology: Primitives / Element / Lesson / Render / Diagnostic, plus
QuestionBank and Course skeletons (core relations OPEN, not invented).
Diagnostic upgrades WarnsIgnored into a severity-tagged checker rule.

Element schema + rich-content model (ADR-0006, ADR-0007):
- docs/adr/0006: kind schema is declarative JSON Schema; field types are built-in
  scalars plus a `content` extension; a `content` value is typst source taken as
  module body; rich content must carry a VirtualPath (else click-to-jump and
  relative import break — verified against typst source); import boundary =
  within the engineering file + @package
- docs/adr/0007: on-disk form is a real directory tree (agent/grep friendly);
  VirtualPath = real relative path; layout conventions deferred
- spec/Courseware/RichContent: prose anchor for rich content (opaque VPath,
  RichContentRef); ElementData kept abstract — JSON/typst internals are
  implementation detail, not contract

lake build green (18 jobs), no sorry, toolchain v4.31.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

spec/Spec/Courseware/Render.lean

@@ -0,0 +1,36 @@
+import Spec.Courseware.Primitives
+
+/-!
+# Render —— 渲染配置矩阵
+
+ADR-0005:某 kind 在某 target 下如何呈现,由一份 **(kind × target) 配置矩阵**决定;
+矩阵住在工程文件里,框架给 default、文件可 override。本模块只建矩阵结构与"是否已
+配置"的判定;规则的**内容**(`RenderRule`)是 OPEN,不碰。
+-/
+
+namespace Spec.Courseware
+
+variable (P : Primitives)
+
+/--
+渲染配置矩阵(`PINNED`, ADR-0005)。
+
+`rule k t = none` 表示 (kind `k`, target `t`) 这一对**尚无渲染规则**;`some _` 表示
+有。框架默认与文件 override 最终都坍缩成这一个映射——契约不区分"默认值"与"用户改
+过的值",只看最终矩阵在每一格的有无。
+-/
+structure RenderConfig where
+  /-- (kind, target) ↦ 该对的渲染规则(无则 `none`)。 -/
+  rule : P.KindId → P.TargetId → Option P.RenderRule
+
+/--
+kind `k` 在 target `t` 下**已配渲染规则**(`PINNED`, ADR-0005)。
+
+即矩阵该格非空。`covers` 为假即"此 kind 在此 target 下无从渲染"——checker 据此报
+警(见 `Spec.Courseware.Diagnostic`)。`P` 隐式,以便 `c.covers k t` 点记法可用。
+-/
+def RenderConfig.covers {P : Primitives} (c : RenderConfig P)
+    (k : P.KindId) (t : P.TargetId) : Prop :=
+  (c.rule k t).isSome
+
+end Spec.Courseware