Conformance: add executable Trace suite candidate - #5

Summary

• adds a self-contained candidate Trace conformance suite owned by this repository
• executes 34 positive, negative, and tamper cases across four Trace document and producer families
• covers all 22 requirements in the named candidate profile
• includes the stable-Rust ps-conformance runner, closed JSON contracts, and deterministic reports
• compares Trace producer output with independent UTF-8 request bytes, invoked entities, boundary outcomes, and external artifacts
• expands the canonical Core corpus from 14 to 101 cases and compares complete normalized Rust and TypeScript outputs
• adds a deterministic 32-family, 100,000-input grammar differential with bounded-memory JSON Lines comparison
• runs ten real Trace producer cases against independently implemented Rust and TypeScript producers
• pins exact implementation commits and freezes all cross-language reports in CI

Candidate scope

Version 0.1.0-rc.1 is stacked on PR #4 at commit 7456634. It is a reviewable candidate, not a released standard, certification utility, or unqualified implementation-conformance claim.

The candidate profile excludes proposed standing authoring surfaces and live provider calls. It treats R5 materialization as an informative cross-tier rule rather than claiming a complete oversight profile.

Provisional semantic defaults

• strict exact entity requests permit only kept or refused outcomes
• substitution requires an explicitly selected best-effort policy and venue-operations authority
• R1 producer checks compare independent UTF-8 request bytes with no normalization or line-ending conversion
• unknown fields are rejected outside namespaced extensions objects

These defaults remain subject to decision 13 review before release.

Validation

• 34 of 34 suite cases passed
• 22 of 22 candidate profile requirements covered
• 101 of 101 canonical Core cases produced identical complete normalized outputs
• 100,000 of 100,000 generated Core inputs matched with zero unexplained differentials
• 10 of 10 Rust and 10 of 10 TypeScript Trace producer cases passed
• deterministic suite and cross-language reports regenerated byte-for-byte
• runner: 16 tests, cargo fmt, and strict cargo clippy passed
• Rust implementation: all targets and strict cargo clippy passed
• TypeScript implementation: 21 tests, 2,736 assertions, typecheck, lint, and build passed
• repository typecheck and production build passed
• six shared parser edge defects were converted into permanent canonical regressions

Follow-up before tagging

Rebase onto the reviewed PR #4 result, perform a requirement-level delta audit, accept or revise the four provisional defaults, require CI to pass, and only then change candidate statuses or create an immutable release tag.