spec: language-neutral conformance runner + TypeScript adapter (#6)

[awbx]

Closes #6 (TypeScript side). Go adapter follow-up: #51.

Summary

A portable conformance runner + TS adapter + CI job. Closes the last original rc.1 issue — every one of the 12 issues in the milestone at session-start is now done or has a tracked follow-up.

What ships

File	Change
`spec/conformance/README.md`	NEW — adapter contract spec: three subcommands, stdin/stdout, JSON I/O. Any future SDK (Rust, Python, Java) ships ~50 LOC of plumbing and gets conformance for free.
`go/cmd/conformance/main.go`	NEW — the runner. Reads vectors, dispatches to the adapter, compares output. Per-vector pass/fail + aggregate; exit 1 on any failure.
`ts/packages/sdk/test/conformance-adapter.mjs`	NEW — TypeScript adapter wrapping the SDK's built dist. 64 vectors / 64 passed.
`.github/workflows/ci.yml`	New `Conformance (TS adapter)` job — builds SDK then runs the runner against the TS adapter. Future Go adapter (#51) joins as a matrix entry.

Why a Go runner (not shell or Python)

• Shell + jq is fragile for multi-step JSON manipulation.
• Python is universal but adds a non-toolchain dependency.
• Go is already required; the runner is a single `main.go` file shipped alongside other `cmd/*` binaries.
• Adapter authors only need their own language's stdlib to write the adapter — they don't need Go for that. They only need Go to run the runner, which is one `go run` command.

End-to-end demo

```
$ pnpm -C ts/packages/sdk build && \
go run ./go/cmd/conformance --vectors spec \
--adapter "node ts/packages/sdk/test/conformance-adapter.mjs"

PASS manifest minimal-job-single-schedule
PASS manifest multi-schedule-canonicalization
...
PASS auth/verify verify-fail/wrong-secret
PASS auth/verify verify-fail/no-acceptable-secret-among-many

64 total / 64 passed / 0 failed
```

Test plan

• Local: `go build ./cmd/conformance` clean
• Local: `golangci-lint run ./cmd/conformance/...` 0 issues
• Local: end-to-end run against TS adapter — 64/64 pass
• CI: new `Conformance (TS adapter)` job passes on this PR — first real exercise
• CI: all 7 required checks still green (no changes to existing jobs)

What's NOT in this PR

• Go adapter (spec: Go conformance adapter for go/cmd/conformance #51, queued for v1.0.0-rc.1) — would prove cross-language byte-for-byte agreement.
• Conformance job promoted to a required status check — defer until Go adapter lands and the job proves stable.
• Adapter contract versioning — implicit at v1 today; if the runner adds new subcommands later, the README will get a version table.