feat: add fixture validator skeleton

[hammadtq]

Summary

• Adds a Go module and thin attach-open-score CLI
• Adds public schema/reason/source/score package skeletons aligned with the v0 docs/spec
• Adds offline fixture validation for current fixtures/v0/*.json
• Validates required fields, decisions/confidence, score bounds, reason taxonomy, source_refs/provenance posture, source_ref links, timestamps, and trailing JSON

Verification

• go test ./...
• go vet ./...
• go run ./cmd/attach-open-score --root .
• git diff --check
• Added-content secret/vendor scan
• Independent review pass found validation/API blockers; fixed and re-reviewed PASS

Source/legal posture

• No network adapters added
• No proprietary vendor data, scores, screenshots, calibration labels, or fixtures added
• Existing fixtures remain synthetic/public-safe
• Source/provenance fields are validated for required attribution posture

Related

• Kanban: t_b239b99e
• Follows merged layout PR: docs: choose Go implementation layout #5

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews