Parameterize receiver-owned resources through setup playbooks

## Problem statement Some workflows need local files, tracker CSVs, directories, or simple databases. Those resources should be declared as receiver-owned setup requirements, not copied from the author machine or hidden inside generated instructions. ## Scope - Convert model/setup requirements into package setup playbook declarations. - Represent local files, tracker CSVs, directories, simple databases, and provider-visible setup instructions. - Link setup requirements to the workflow steps that need them. - Integrate with the receiver activation model from #72. - Ensure repeated setup remains idempotent and permission-gated. ## Acceptance criteria - A compiled package can declare receiver-owned setup resources without including author-owned files. - Setup requirements are visible in package inspection and validation output. - Generated setup declarations are compatible with #72. - Tests cover tracker files, directories, refused setup, repeated setup, and missing setup declarations. ## Dependencies - Depends on #72, which is still open. - Depends on the sanitization pass identifying receiver-owned resources. ## Non-goals - Do not implement full setup execution if #72 has not landed. - Do not store shared secrets or API keys. - Do not silently create files on the receiver machine. ## Sequencing Land after the base sanitization pass and coordinate closely with #72.