ci: enforce installed table-kit to dmcheck conformance

[chaoz23]

Summary

Adds the hosted, cold-installed table-kit → dmcheck conformance gate required
by PORT-001/PORT-002.

This is intentionally stacked on #12 (agent/legacy-event-adapter). The
workflow pins dmcheck#9 at exact commit
ce7ce6f3959227c7db86e3264fd6c5aecda80a48, builds both wheels, installs them
outside either checkout, and runs the public command boundary.

Conformance cases

• complete checked_clean result
• complete findings result retaining exact TableEvent evidence ID
• canonical transport gap remains incomplete, never clean
• legacy migration is byte-deterministic and preserves native ID only as
  provenance, not event identity or authority
• redacted legacy content remains typed incomplete, never a false negative

Every event/result is validated with the installed table-kit JSON Schema and
semantic validators. The script also proves both Python modules were imported
from the cold environment rather than either checkout.

Validation

• cross-repository cold-wheel gate passes all five cases locally
• 340 Python tests + 73 subtests pass
• 18 Node tests pass
• generated contract declarations, script compilation, and whitespace checks
  pass

Dependencies / sequencing

• table-kit Establish shared evaluation and event contracts #11 and feat: migrate legacy ledgers to table.event/1.0 #12 are merged; this PR is rebased directly on main
• dmcheck [PORT-002][RFC][P0] Define TableEvent v1 and prove table-kit → dmcheck compatibility with a golden session #8 and [PORT-003][RFC][P0 before live-agent use] Define host-owned session authority and evidence provenance boundaries #9 are merged; this gate pins the resulting [PORT-003][RFC][P0 before live-agent use] Define host-owned session authority and evidence provenance boundaries #9 main commit
• the pin is an integration lock, not a runtime or release dependency
• no package release, host authority, or protected-host implementation is
  included