ci(rootbundle): lock compatibility vectors

[weikengchen]

Summary

• add byte-for-byte v1 payload and signed-bundle golden vectors
• verify decode/re-encode and 2-of-2 quorum compatibility against those vectors
• add a deterministic vector generator and compatibility/release policy
• add rootbundle-specific and full-workspace GitHub Actions gates

This is the first safety gate before BitcoinPIR pins this repository and removes its stale nested rootbundle copy.

Verification

• cargo test --locked -p rootbundle --all-targets
• cargo test --locked --workspace --all-targets

Follow-up

After merge, configure the rootbundle compatibility check as required and protect the rootbundle-v* release tag namespace. Then the BitcoinPIR consumer can pin an exact commit, run production-bundle compatibility verification, and delete the nested copy.