ci: enforce installed srdcheck result conformance

[chaoz23]

Summary

Extends the hosted installed-wheel portfolio gate to srdcheck's
table.evaluation/1.0 projection.

This is intentionally stacked on #13 (agent/crossrepo-conformance). It pins
srdcheck#60 at exact commit
236188326fc7a1210f1d3aff3a1fc7c3ccd7bec8, builds both candidate wheels,
cold-installs them outside either checkout, and runs the public CLI boundary.

Conformance cases

• successfully adjudicated legal query → checked_clean
• failed saving throw remains a complete adjudication, not an illegal finding
• illegal Mage Hand attack → findings with exact rule evidence
• missing condition/query facts → incomplete
• unsupported SRD content → unsupported
• malformed query fields → invalid
• repeated identical query/result is byte-for-byte deterministic

Every envelope is validated with the installed table-kit JSON Schema and
semantic validator. The script proves both modules are imported from the cold
environment, and every result remains self_attested.

Validation

• six-case cold-wheel gate passes locally
• 340 Python tests + 73 subtests pass
• 18 Node tests pass
• generated contract declarations, script compilation, and whitespace checks
  pass

Dependencies / sequencing

• table-kit Establish shared evaluation and event contracts #11 and feat: migrate legacy ledgers to table.event/1.0 #12 are merged; merge ci: enforce installed table-kit to dmcheck conformance #13 before retargeting this PR to
  main
• srdcheck #60 is merged; this gate pins its resulting main commit
• the pin is an integration lock, not a runtime or release dependency
• no release or authority expansion is included