OnnxModelContract

Checks that a loaded ONNX graph is the graph its manifest promises, before a single row is scored.

The engine feeds a session by name (session.run takes a name → tensor map) and reads the first output by position, so a graph whose input is called something else fails inside the runtime with a message about a missing input, and a graph whose output is a different tensor than expected is scored anyway — the observed cause of the Python/JVM disagreement this contract exists to end (the repository's own older fixtures name their output variable, which the JVM reads by index and the contract now rejects by name).

A width mismatch is the other half: [batch, 27] fed 13 floats is an error, [batch, 13] fed a 13-column row from the wrong schema is not — which is why the schema id is checked in the manifest and the width here. Both must hold.