Part of #3896 phase 1.

Summary

Add the foundational TypeScript contracts for the isolated src/lib/messaging module. This issue should define the serializable manifest and plan shapes only; it should not switch any current workflow to the new path.

Scope

• Add src/lib/messaging/manifest/types.ts.
• Define ChannelManifest with channel identity, supported agents, auth, inputs, credentials, policy, render, state, and hook specs.
• Define initial serializable plan shapes for future compilation, including channel plans, credential bindings, policy requirements, render fragments, build inputs, state updates, and hook references.
• Model secrets as references/placeholders only. Do not store raw secret values in the plan.
• Add index exports for the new module surface.

Acceptance Criteria

• Manifest and plan objects can be JSON-serialized and parsed back without losing required fields.
• Manifest types contain no function-valued fields.
• The new module does not import gateway, registry, credentials, filesystem, subprocess, OpenShell adapter, or command/action layers.
• Tests include representative fixture manifests and prove secret values are not required in fixtures.
• Existing onboarding, channel add/remove, rebuild, OpenClaw rendering, and Hermes rendering behavior is unchanged.

Notes

Current channel metadata starts in src/lib/sandbox/channels.ts, but phase 1 should introduce the next contracts beside it rather than replacing it.