fix(ci): fetch integrity public key from spec repo

For fork PR conformance, download the public integrity key from
intentproof-spec and pass it via INTENTPROOF_SPEC_INTEGRITY_PUBLIC_KEY_PATH.

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -108,14 +108,21 @@ jobs:
           cache: npm
           cache-dependency-path: intentproof-spec/package-lock.json
 
+      - name: Fetch spec integrity public key
+        env:
+          SPEC_INTEGRITY_KEY_URL: https://raw.githubusercontent.com/IntentProof/intentproof-spec/main/keys/spec-integrity.public.pem
+        run: |
+          set -euo pipefail
+          curl -fsSL "${SPEC_INTEGRITY_KEY_URL}" -o "${RUNNER_TEMP}/spec-integrity.public.pem"
+
       - name: Canonical spec conformance (pin check + oracle + replay)
         env:
           INTENTPROOF_SPEC_ROOT: ${{ github.workspace }}/intentproof-spec
           INTENTPROOF_SDK_ID: python
           INTENTPROOF_REPLAY_VERIFY: "1"
           INTENTPROOF_CONFORMANCE_JSON: "1"
           INTENTPROOF_CERTIFICATE_SCHEMA_VERSION: "v2"
-          INTENTPROOF_SPEC_INTEGRITY_PUBLIC_KEY_PEM: ${{ secrets.INTENTPROOF_SPEC_INTEGRITY_PUBLIC_KEY_PEM }}
+          INTENTPROOF_SPEC_INTEGRITY_PUBLIC_KEY_PATH: ${{ runner.temp }}/spec-integrity.public.pem
         run: bash scripts/spec-conformance.sh
 
       - name: Upload conformance report artifact