Resolve lifecycle specs from caller cwd

[rogu3bear]

Summary

• Resolves relative hostname and maildesk-cf lifecycle --file paths against the caller's working directory when that file exists.
• Falls back to the cfctl repo state/ directory so existing built-in examples keep working.
• Adds a maildesk lifecycle contract regression for caller-relative specs.

Test plan

• python3 -m py_compile scripts/cf_maildesk_cf_lifecycle.py scripts/cf_hostname_lifecycle.py
• bash scripts/verify_maildesk_cf_contract.sh
• ./scripts/verify_static_contract.sh
• From /Users/star/dev/star-maildesk-cf: cfctl maildesk-cf verify --file config/desired-state.local.json
• ./scripts/verify_public_contract.sh blocked locally: CFCTL_PUBLIC_CONTRACT_ZONE is not set for live DNS/token smoke tests

Risk / review focus

• Confidence: high for the maildesk caller-relative path because the contract reproduces the app-repo invocation that failed.
• Review focus: confirm fallback ordering is right when both caller cwd and cfctl state/ contain a same-named relative spec.
• Operational implication: app repos can use their documented relative desired-state paths without expanding to absolute paths first.

[rogu3bear]

@codex Please review the lifecycle spec resolver change, especially fallback ordering when a relative path exists both in the caller repo and under cfctl state examples.

[rogu3bear]

Local proof is green (python3 -m py_compile, bash scripts/verify_maildesk_cf_contract.sh, ./scripts/verify_static_contract.sh, and the caller repo cfctl maildesk-cf verify --file config/desired-state.local.json readback). GitHub static contract is failing before any runner steps are recorded, matching the existing main startup-failure pattern rather than a script assertion failure.