Serialize the catalog section — mandatory even when empty; hard-fail load and pre-flight without it #583

Feature: #581 · Phase 1 of resource-construction.md.

graphData gains a mandatory resources section — every current-generation entry as pending intent
({id, uri, state: pending}); content entries additionally carry packed bytes as today; present even empty
(no omitempty). LoadGraph: a document without the section is a hard error. Executor pre-flight: a graph
without a catalog fails with ReasonPreflightFailed before any dispatch. Round-trip pin: pack → unpack →
pack byte-identical, including the empty section. Windows baseline holds at 3.