feat(3.1.0): align with UAPF v2.4.0 — algorithm card refs move to BPMN task

UAPF v2.4.0 reverses the v2.3.0 decision to place algorithm card
references on resource targets. The card belongs on the BPMN task
itself, where it is visible as a first-class process element and its
inputs/outputs render as visible data objects on the diagram.

Changes from v3.0.0:
- bpmn/semantic-document-analysis.bpmn: each of 3 service tasks now
  carries xmlns:uapf24=https://uapf.dev/bpmn/v2.4 + the
  uapf24:algorithmCardRef attribute pointing at the governing card,
  plus a <bpmn:ioSpecification> synthesised from the card's io block
  so inputs/outputs render as visible data objects
- resources/mappings.yaml: algorithm_card dropped from each of the
  3 targets (they go back to being just dispatch endpoints)
- uapf.yaml + manifest.json: version 3.0.0 -> 3.1.0
- README rewritten with v3.1.0 delta + audit-question table

Cards themselves are unchanged. DMN files are unchanged.

uapf.yaml

@@ -18,15 +18,15 @@ description: |
   versioned DMN — inspectable, auditable, portable. Extraction output
   validates against the VDVC v1.1 semantic-summary JSON Schema.
 
-  v3.0.0: the three opaque host capabilities (ai.redact@1,
-  ai.extract@1, event.emit@1) are now governed by Algorithm Cards
-  in algorithms/ per UAPF v2.3.0 chapter 13. Each Card supplies the
-  intent, IO contract, ownership, validation history, risk class,
-  and audit configuration for one algorithm. Cards are referenced
-  from resource targets in resources/mappings.yaml.
+  v3.1.0: aligned with UAPF v2.4.0 — Algorithm Card references move
+  from resource targets to the BPMN service tasks themselves (via
+  uapf24:algorithmCardRef attribute). Each card's io block is also
+  denormalised into a <bpmn:ioSpecification> on the task so inputs
+  and outputs render as visible data objects on the diagram. The
+  cards themselves and the DMN decisions are unchanged from v3.0.0.
 
 level: 4
-version: "3.0.0"
+version: "3.1.0"
 
 # ── UAPF-IP integration (capability needs + profile + guardrails) ──
 requires_capabilities: