Read signing golden fixtures from spec checkout

[negillett]

Summary

• Prefer INTENTPROOF_SPEC_DIR/golden/sdk-signing in signing golden tests.
• Add scripts/check-sdk-signing-fixtures-sync.sh to fail when local mirrors drift from spec.

Phase 3 drift D.9. Requires spec #100 on main for CI green.

Test plan

• npm test
• npm run build

[cursor]

PR Summary

Low Risk
Test and CI wiring only; no runtime signing or application logic changes.

Overview
Signing golden tests now load fixtures from INTENTPROOF_SPEC_DIR/golden/sdk-signing when that env var is set (as in CI), and still fall back to tests/fixtures locally.

CI checks out intentproof-spec, and if golden/sdk-signing is missing on main, it fetches phase3-ecosystem-conformance so tests can run before spec lands on main. A new scripts/check-sdk-signing-fixtures-sync.sh step fails the build when any mirrored signing_* file under tests/fixtures differs from the spec golden copy.

^{Reviewed by Cursor Bugbot for commit 07d6c9a. Bugbot is set up for automated code reviews on this repo. Configure here.}