feat(3.1.0): align with UAPF v2.4.0 — algorithm card refs move to BPMN task

UAPF v2.4.0 reverses the v2.3.0 decision to place algorithm card
references on resource targets. The card belongs on the BPMN task
itself, where it is visible as a first-class process element and its
inputs/outputs render as visible data objects on the diagram.

Changes from v3.0.0:
- bpmn/semantic-document-analysis.bpmn: each of 3 service tasks now
  carries xmlns:uapf24=https://uapf.dev/bpmn/v2.4 + the
  uapf24:algorithmCardRef attribute pointing at the governing card,
  plus a <bpmn:ioSpecification> synthesised from the card's io block
  so inputs/outputs render as visible data objects
- resources/mappings.yaml: algorithm_card dropped from each of the
  3 targets (they go back to being just dispatch endpoints)
- uapf.yaml + manifest.json: version 3.0.0 -> 3.1.0
- README rewritten with v3.1.0 delta + audit-question table

Cards themselves are unchanged. DMN files are unchanged.

resources/mappings.yaml

@@ -2,10 +2,11 @@ kind: uapf.resources.mapping
 
 # Host-readable contract for the capability-backed service tasks.
 #
-# v3.0.0 change: the single agent.semantic-extractor target has been
-# split into three algorithm-specific targets, each referencing an
-# Algorithm Card under algorithms/ (UAPF v2.3.0, chapter 13). The
-# binding shape is unchanged. The BPMN file is unchanged.
+# v3.1.0 change: the algorithm_card reference (added in v3.0.0 on each
+# target) has been removed per UAPF v2.4.0 — the Algorithm Card reference
+# now lives on the BPMN serviceTask itself via the
+# uapf24:algorithmCardRef attribute (see bpmn/semantic-document-analysis.bpmn).
+# Targets here keep their role as dispatch endpoints only.
 #
 # The three DMN decisions (assess-personal-data-risk,
 # gdpr-processing-route, human-validation-gate) remain self-describing
@@ -21,7 +22,6 @@ targets:
       pii_redactor Algorithm Card.
     capabilities:
       - capability.ai.redact
-    algorithm_card: algo.semantic_document_analysis.pii_redactor
 
   - id: agent.vdvc_semantic_extractor
     type: ai_agent
@@ -33,7 +33,6 @@ targets:
       enforced downstream by the human-validation-gate DMN.
     capabilities:
       - capability.ai.extract
-    algorithm_card: algo.semantic_document_analysis.vdvc_semantic_extractor
 
   - id: agent.completion_event_emitter
     type: ai_agent
@@ -43,7 +42,6 @@ targets:
       completion_event_emitter Algorithm Card.
     capabilities:
       - capability.event.emit
-    algorithm_card: algo.semantic_document_analysis.completion_event_emitter
 
 bindings:
   - source: { type: bpmn.serviceTask, ref: Task_DetectRedactPii }