feat: add vendored API contracts and conformance fixtures

[kevinnguy]

Summary

This PR is intentionally limited to the checked-in API contract and conformance data layer. It contains no packages/** changes.

• Vendor the REST, prediction-markets, and WebSocket specifications under specs/ with SHA-256 metadata and an explicit refresh command.
• Add the numeric policy and reviewed Gemini wire-exception overlays.
• Add 35 language-neutral conformance fixtures and the fixture schema documentation under conformance/.
• Update .gitattributes, CI path filters, and CODEOWNERS for the new top-level trees.

The TypeScript/Go generator, SDK, and conformance-runner changes remain on the original branch and PR #59: #59

Scope

Included:

• specs/**
• conformance/**
• .gitattributes
• .github/CODEOWNERS
• .github/workflows/validate-go-sdk.yml
• .github/workflows/validate-typescript-sdk.yml

Excluded:

• Every packages/** change

Verification

• Vendored refresh completed with all three specs unchanged.
• Digest tampering was detected by both SDK loaders before restoring the spec.
• Removing a fixture from conformance/manifest.json failed both manifest guards before restoring it.
• The complete implementation branch was verified with the TypeScript and Go conformance suites and SDK checks before this split.

[nostradamus-bot]

Nostradamus Risk Rating — Low

PR #62 adds only vendored API specification files (specs/), language-neutral conformance fixtures (conformance/), and CI/tooling configuration with zero packages/** changes; the HMAC conformance fixtures contain synthetic test-only credentials that grant no API access, and the spec refresh script includes SHA-256 digest verification as a tamper-detection control.

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Kevin Nguy
• Type of change: Normal

Testing — ⚠️ Incomplete

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ⏳ Pending — re-run Clarissa once CI checks complete
• Testing summary: ✅ Found in PR description
  • Summary: Vendored refresh and digest tampering detection were tested successfully, with both SDK loaders identifying tampering before restoration. Manifest guard validation and conformance suite verification across TypeScript, Go, and SDK implementations were completed without issues.
• Evidence link: View run

Approval — ⏳ Awaiting approval

Evidence:
(no approvers yet)

Segregation of Duties — ⏳ Awaiting approval

Validated:

• PR author: Kevin Nguy

---

Last checked: 2026-09-17 20:33 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.