feat: law-source-bund 0.1.0 (source.bundesrecht)

Fetch one German federal law from gesetze-im-internet.de (BMJ) by its
site slug, unpack the BMJ norm XML from the site's xml.zip and return
it content-addressed (SHA-256) plus the BMJ builddate, so a flow's
audit trail pins the exact Gesetzesstand it processed.

- xml.zip unpack picks the largest XML entry (norm body)
- lying ZIP size header rejected instead of silently truncated
  (audit integrity); 64 MB unpack cap, 96 MB download cap
- net permission pinned to www.gesetze-im-internet.de; no auth
- 11 unit tests (no network), wasm32-wasip2 build green

Signed-off-by: flemming-it <sf@flemming.it>

assets/icon.svg

@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="12" fill="#08090A"/>
+  <circle cx="32" cy="32" r="17" fill="none" stroke="#E9E7E2" stroke-width="3"/>
+  <g fill="#2E8F9E">
+    <circle cx="32" cy="18.5" r="2"/>
+    <circle cx="38.75" cy="20.3" r="2"/>
+    <circle cx="43.7" cy="25.25" r="2"/>
+    <circle cx="45.5" cy="32" r="2"/>
+    <circle cx="43.7" cy="38.75" r="2"/>
+    <circle cx="38.75" cy="43.7" r="2"/>
+    <circle cx="32" cy="45.5" r="2"/>
+    <circle cx="25.25" cy="43.7" r="2"/>
+    <circle cx="20.3" cy="38.75" r="2"/>
+    <circle cx="18.5" cy="32" r="2"/>
+    <circle cx="20.3" cy="25.25" r="2"/>
+    <circle cx="25.25" cy="20.3" r="2"/>
+  </g>
+</svg>