Adopt RELAY v1.10 §20 continuous-conformance CI gates #26

RELAY spec v1.10 (release) adds §20 Continuous Conformance, making the CI process normative: conformance must be continuously proven, not just declared.

§20 requires, on every change, that CI gates on:

1. relay conform --strict against the built CLI (fail on FAIL or WARN).
2. The full cpp-FuSa lifecycle — not a subset: check (gate on ERROR), 100% requirement traceability (traced and tested), cybersecurity analysis, dependency vulnerability scan, and the tool qualification suite.
3. relay interop behavioural conformance (once convert exists) — EQUIVALENT for every golden vector.
4. Evidence (§20.4): a traced+tested requirements registry, a HARA, a dFMEA, and a TARA where untrusted input is processed.
5. Supply-chain (§20.5): SBOM + build provenance (SLSA), releases tagged from green CI.

RELAY itself is the reference exemplar — its CI now runs the full go-FuSa lifecycle and passes every gate.

What cpp-RCP needs

Has HARA + TARA. Expand to the full cpp-FuSa lifecycle (qualify, vuln, trace). Add a dFMEA, SBOM/provenance, and — once convert lands (#17/#21) — the relay interop gate. (CLI build target also needs fixing so conform runs.)

This builds on the §13.7 architecture + spec-uplift issue already open. No changes are requested to RELAY. Verify with relay conform --strict + the full cpp-FuSa lifecycle locally.

Definition of done — the entire current spec (v1.10)

This issue lists the §20 deltas, but the bar is the whole current RELAY spec — v1.10 (the latest release), not only §20, and not the "1.9" mentioned in the earlier §13.7 issue (now superseded). The implementation is conformant when:

• version --format json reports spec_version 1.10 (track spec/version.json in SoundMatt/RELAY);
• relay conform --strict <binary> passes — the full §12 / §17 document and behaviour surface;
• relay interop reports the implementation EQUIVALENT for every golden vector (§20.2), once convert is conformant;
• the full x-FuSa lifecycle passes (§20.1.2);
• all normative sections are satisfied — §13.7 architecture, §15 canonical types (including CAN XL / ESI where applicable), §5 sentinels, §6 lifecycle, etc. — not just the sections cited above.

Re-verify against spec/version.json after each RELAY MINOR release.