Add golden fixtures and deterministic regression checks

[sehkone]

Problem

As the pipeline grows, changes to one component can silently break bundle output. Fixed reference bundles are needed to catch regressions.

Scope

• Generate golden bundles from AC-0, AC-1, and AC-2 scenarios with fixed seeds and fixed start_at (the latter delivered by Add scenario start time and time compression with timestamp rewriting #67)
• Store expected bundle assertions (directory structure, file presence, GT record counts, key field values)
• Implement regression tests that compare generated bundles against golden fixtures
• Test both positive cases (valid bundles pass) and negative cases (intentionally broken bundles fail)

Relationship to #67 (start_at + time compression)

#67 introduces start_at and per-execution anchoring so that timestamps in the bundle are deterministic across runs. After #67 lands, PCAP packet timestamps, JSONL timestamps, and meta.json timestamps are reproducible byte-for-byte when the scenario sets a fixed start_at.

Division of labor:

• Update fixtures and CI for fixed start_at and time-compression #66 (sub-issue of Add scenario start time and time compression with timestamp rewriting #67): updates AC-0/AC-1/AC-2 scenario YAML to set fixed start_at, regenerates fixtures for the timestamp axis, and asserts intra-session and inter-session timing semantics.
• Add golden fixtures and deterministic regression checks #23 (this issue): the broader determinism work — schema, path, GT record counts, and key field values across the bundle. Builds on top of Update fixtures and CI for fixed start_at and time-compression #66's fixture baseline.

Out of Scope

• Byte-level PCAP comparison of fields that are still non-deterministic after Add scenario start time and time compression with timestamp rewriting #67 (e.g., OS-assigned ephemeral source ports unless pcap::enrich_src_ports pins them in tests, transient TCP options). Timestamp non-determinism is no longer a blocker after Add scenario start time and time compression with timestamp rewriting #67.
• Performance benchmarking
• Fuzz testing

Done when

• Golden fixtures are committed to the repository
• Regression checks catch schema, path, and Ground Truth regressions
• Both Generator and Validator changes trigger fixture comparison

Dependencies

• Run AC-1 and AC-2 end-to-end and fix integration gaps #21 (AC-1 and AC-2 must be stable to produce reliable fixtures)
• Add scenario start time and time compression with timestamp rewriting #67 (deterministic timestamps via start_at); Update fixtures and CI for fixed start_at and time-compression #66 ships the scenario-side fixture updates that Add golden fixtures and deterministic regression checks #23 builds on