Document OPC ZIP surgery and VBA binding contracts

[kiki830621]

Refs #136
Refs #138

Summary

• document the fixed .xlsx → .xlsm OPC delta and conditional document-module binding delta
• define vbaProject.bin provenance, carrier inventory, per-target binding, and exact untouched-entry/reverse-patch fidelity contracts
• absorb the ThisWorkbook／worksheet codeName silent-no-op failure from issue 138 and require a macro-exclusive execution witness
• specify hostile-OPC, privacy, consent, protected-package, private-staging, and descriptor-anchored atomic no-replace boundaries
• hand the resulting typed implementation and integration-test checklist to issue 135

Verification

• Requirements: PASS
• Logic／Evidence + final Devil’s Advocate: PASS
• Security／Privacy／Data Integrity: PASS
• 0 blocking findings at authoritative SHA 554b8a895d6d1faeaec3c66688c10263dd39649a
• git diff --check origin/main..HEAD: PASS
• docs-only change; no Swift runtime tests required
• Codex cross-model HTTP channel produced no result after one service error and one bounded timeout; this INFO process gap is disclosed in both issue verification reports

Verification reports:

• docs: OPC zip 手術論述 — .xlsm 巨集注入、vbaProject.bin 工作流與 byte 級保真驗證 #136 (comment)
• docs: VBA 注入的 document-module 綁定陷阱 — codeName 缺失讓巨集「看似正常、執行全滅」(429/靜默 no-op) #138 (comment)

Scope

This PR documents the contract. It does not implement inject_vba, run a macro, add an XLSX converter route, or claim that issue 135 product capabilities already exist.

Issues 136 and 138 remain open. After review and merge, use the IDD closing workflow for each issue.