feat: law-source-bund 0.1.0 (source.bundesrecht)

Fetch one German federal law from gesetze-im-internet.de (BMJ) by its
site slug, unpack the BMJ norm XML from the site's xml.zip and return
it content-addressed (SHA-256) plus the BMJ builddate, so a flow's
audit trail pins the exact Gesetzesstand it processed.

- xml.zip unpack picks the largest XML entry (norm body)
- lying ZIP size header rejected instead of silently truncated
  (audit integrity); 64 MB unpack cap, 96 MB download cap
- net permission pinned to www.gesetze-im-internet.de; no auth
- 11 unit tests (no network), wasm32-wasip2 build green

Signed-off-by: flemming-it <sf@flemming.it>

module.yaml

@@ -0,0 +1,70 @@
+schema_version: 3
+provider: chain
+name: law-source-bund
+version: 0.1.0
+
+# Capability provided by this module.
+#
+# Fetches one German federal law from gesetze-im-internet.de (BMJ)
+# by its site slug and returns the BMJ XML content-addressed
+# (SHA-256), so a flow's audit trail pins the exact Gesetzesstand
+# it processed. Public BMJ data only — no authentication, no
+# personal data.
+provides:
+  - capability: source.bundesrecht
+    version: 0.1.0
+
+inputs:
+  gesetz:
+    type: text
+    description:
+      en: |
+        gesetze-im-internet.de slug of the law, e.g. bgb, estg,
+        gg, or stromnzv. The slug is the path segment of the law's
+        page (https://www.gesetze-im-internet.de/<slug>/).
+      de: |
+        Kürzel (Slug) des Gesetzes auf gesetze-im-internet.de,
+        z. B. bgb, estg, gg oder stromnzv. Der Slug ist das
+        Pfadsegment der Gesetzes-Seite
+        (https://www.gesetze-im-internet.de/<slug>/).
+
+outputs:
+  xml:
+    type: bytes
+    description:
+      en: |
+        BMJ norm XML (gii-norm DTD) as unpacked from the site's
+        xml.zip. Feed into text.akoma-normalize for the structured
+        Akoma-Ntoso-aligned representation.
+      de: |
+        BMJ-Normen-XML (gii-norm-DTD) aus dem xml.zip der Seite.
+        Für die strukturierte Akoma-Ntoso-Darstellung an
+        text.akoma-normalize weiterreichen.
+  meta:
+    type: json
+    description:
+      en: |
+        JSON-encoded SourceMeta:
+          {
+            schema_version: "0.1",
+            gesetz: "bgb",
+            url: "https://www.gesetze-im-internet.de/bgb/xml.zip",
+            source_sha256: "…",     // hash of the unpacked XML bytes
+            byte_len: 123456,
+            builddate: "20260701120000"   // from the XML header, if present
+          }
+        source_sha256 is the versioning anchor: gesetze-im-internet
+        serves only the current consolidated state, so the hash (plus
+        the BMJ builddate) is what makes a later re-fetch comparable.
+      de: |
+        JSON-codiertes SourceMeta (Felder s. EN). source_sha256 ist
+        der Versionsanker: gesetze-im-internet liefert nur den
+        aktuellen konsolidierten Stand — Hash + BMJ-builddate machen
+        einen späteren Re-Fetch vergleichbar.
+
+# Permissions required.
+#
+# One pinned host: the module talks to gesetze-im-internet.de
+# (BMJ / juris publication site) and nothing else.
+permissions:
+  - "net: www.gesetze-im-internet.de"