feat: harden CRUD resource contract checks (AEG-V16-020)

Reject incomplete permission, version, concurrency, idempotency, and sensitive-column contracts. Preserve runtime regression evidence; status remains IN_PROGRESS pending predecessor acceptance.

docs/CURRENT/AEG-V16-020_CRUD_RESOURCE_V2_SLICE_NOTE.md

@@ -0,0 +1,20 @@
+# AEG-V16-020 — CRUD Resource v2
+
+## Scope
+
+- **WBS / Requirement / UI / Test:** AEG-V16-020 / REQ-V16-FEC-04 / UI-V16-FEC-04 / T-V16-FEC-04
+- **Classification:** shared CRUD contract hardening; no API, database, or policy change.
+
+## Source / Assumption / Unknown / Decision Required
+
+- **Source:** `contracts/ui/crud-resource.v2.json`, `frontend/src/shared/crud/resourceDefinition.*`, and the shared CRUD contract types.
+- **Assumption:** individual resource definitions originate from approved API contracts; this assertion prevents invalid local definitions but does not authorize a server mutation.
+- **Unknown:** predecessor AEG-V16-019 is pending formal UX/a11y evidence.
+- **Decision Required:** no new permission names or sensitive-field masks are introduced; resource owners supply them through approved definitions.
+
+## Acceptance mapping and execution evidence
+
+- Zod schema/version, permission, concurrency, idempotency, and sensitive-column consistency are explicitly checked.
+- A sensitive field now requires both a declared column and `sensitive: true`, avoiding accidental unmasked display.
+- `frontend: pnpm test -- --run src/shared/crud/tests/resourceDefinition.spec.ts` passed: 1 file / 3 tests.
+- `frontend: pnpm typecheck` passed before the generated JS companion synchronization; the later JS-only synchronization is covered by the passing runtime test.