ci: enforce installed charactercheck result conformance

[chaoz23]

Summary

Completes the hosted installed-wheel producer set by adding CharacterCheck's
table.evaluation/1.0 projection to table-kit's cross-repository gate.

This is based directly on merged table-kit main. It pins merged
charactercheck#32 at exact squash commit
db92352e67c6e7839a53ae059a0bf93f21a1e161, builds both candidate wheels,
cold-installs them outside either checkout, and runs the public CLI boundary.

Conformance cases

• unsupported sheet mechanics remain unsupported
• a mechanically covered sheet remains checked_with_advisories because
  mutable HP/slots/stance/resources/inventory require player/session authority
• unknown-scope source coverage remains incomplete
• invalid field mechanics remain invalid
• malformed references remain privacy-safe invalid results
• repeated identical observation/result is byte-for-byte deterministic even
  though native observation timestamps differ

Every envelope is validated with the installed table-kit JSON Schema and
semantic validator. The script proves both modules are imported from the cold
environment, verifies character names/refs do not leak, and requires every
result to remain self_attested.

Validation

• six-case cold-wheel gate passes locally
• 340 Python tests + 73 subtests pass
• 18 Node tests pass
• generated contract declarations, script compilation, wheel build, and
  whitespace checks pass

Dependencies / sequencing

• table-kit Establish shared evaluation and event contracts #11 through ci: enforce installed srdcheck result conformance #14 are merged; this PR targets main
• charactercheck [TK-013] Missing *required* flags still exit 2, while malformed flags exit 3 #31 and #32 are merged; this gate pins #32's resulting main
  squash commit
• the pin is an integration lock, not a runtime or release dependency
• this supplies four-tool contract conformance; it does not create the future
  protected suite host or expand authority
• no release is included