P0: Add PoCI validation and cross-language checks to CI

[safal207]

Parent: #180
Depends on: #185, #186, #187

Objective

Make PoCI conformance a required automated quality gate for every relevant change.

CI stages

1. validate JSON Schema and examples;
2. run Python fixture verifier;
3. run Python tests and determinism checks;
4. run Rust verifier tests when P1: Extend Rust verifier with PoCI envelope validation #186 is available;
5. compare Python and Rust golden roots;
6. upload normalized verification outputs as artifacts;
7. fail on fixture drift unless golden vectors are intentionally updated.

Requirements

• use pinned tool versions where practical;
• no network dependency during verification;
• clear failure messages naming fixture and invariant;
• cache only build dependencies, never generated verdicts;
• protect against an empty fixture glob falsely passing;
• document the local equivalent commands.

Definition of done

• Pull requests fail when any fixture verdict changes unexpectedly.
• Pull requests fail when Python and Rust roots diverge.
• At least one known-bad fixture is verified as rejected in CI.
• Workflow artifacts include the conformance report.
• README badge or status link points to the PoCI check.

[safal207]

Implemented in draft PR #196: dedicated PoCI workflow, 12-case corpus drift guard, Python compilation/tests, manifest report validation, demo execution, and poci-conformance-<run_id> artifact upload with fail-on-missing behavior. The Python/Rust golden-root comparison acceptance criterion remains pending #186 and is explicitly not claimed by this PR.

[safal207]

PR #197 completes the cross-language portion deferred from #196: Python and Rust now generate independent conformance reports, and CI compares all 12 decisions, primary reason codes, and computed envelope roots.