feat: law-source-bund 0.1.0 (source.bundesrecht)

Fetch one German federal law from gesetze-im-internet.de (BMJ) by its
site slug, unpack the BMJ norm XML from the site's xml.zip and return
it content-addressed (SHA-256) plus the BMJ builddate, so a flow's
audit trail pins the exact Gesetzesstand it processed.

- xml.zip unpack picks the largest XML entry (norm body)
- lying ZIP size header rejected instead of silently truncated
  (audit integrity); 64 MB unpack cap, 96 MB download cap
- net permission pinned to www.gesetze-im-internet.de; no auth
- 11 unit tests (no network), wasm32-wasip2 build green

Signed-off-by: flemming-it <sf@flemming.it>

Cargo.toml

@@ -0,0 +1,52 @@
+# Standalone Cargo.toml — targets wasm32-wasip2.
+#
+# Build with:
+#   cargo build --release --target wasm32-wasip2
+
+[package]
+name = "law_source_bund"
+version = "0.1.0"
+edition = "2024"
+authors = ["Dr. Stefan Flemming <chain@flemming.ai>"]
+license = "Apache-2.0"
+publish = false
+description = "F∆I module — fetch German federal law from gesetze-im-internet.de by slug (BMJ XML, content-addressed)"
+repository = "https://git.flemming.ai/chain-modules/law-source-bund"
+rust-version = "1.85"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+chain-module-sdk = { git = "https://git.flemming.ai/fai/chain-module-sdk-rust.git", tag = "v0.3.0" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+# gesetze-im-internet serves each norm as an xml.zip archive.
+# Pure-Rust deflate only — same restricted feature set text-extract
+# uses (deflate64/bzip2/zstd stay out of the WASM build).
+zip = { version = "2", default-features = false, features = ["deflate"] }
+
+# WASI-0.2 HTTP client — same one http-request / law-source-eurlex use.
+# Only compiled into the wasm32-wasip2 build.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+waki = "0.5"
+
+[profile.release]
+opt-level = "s"
+lto = true
+codegen-units = 1
+strip = "symbols"
+
+[lints.rust]
+unsafe_op_in_unsafe_fn = "warn"
+
+[lints.clippy]
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+print_stdout = "deny"
+print_stderr = "deny"
+
+[workspace]
+# Empty workspace table so this package is NOT picked up by a parent.