The BPMN already invokes ai.redact@1 / ai.extract@1 / event.emit@1 and the
package ships resources/guardrails.yaml. Declaring them at manifest level so
the ProcessGit /uapf-ip endpoint and a UAPF-IP runtime can discover the
package contract before loading it.