Read signing golden fixtures from spec checkout

[negillett]

Summary

• Prefer INTENTPROOF_SPEC_DIR/golden/sdk-signing in signing golden tests.
• Checkout spec in CI; add fixture sync gate.

Phase 3 drift D.9. Requires spec #100 on main for CI green.

Test plan

• python3 -m pytest
• bash scripts/run-coverage-gate.sh

[cursor]

PR Summary

Medium Risk
Changes how signing conformance is validated in CI and ties releases to an external spec repo/branch fallback, but does not alter runtime signing logic in the SDK.

Overview
Signing golden tests now read fixtures from INTENTPROOF_SPEC_DIR/golden/sdk-signing when that env var is set, and otherwise keep using tests/fixtures for local runs.

CI checks out IntentProof/intentproof-spec, falls back to phase3-ecosystem-conformance if golden/sdk-signing is missing on main, runs coverage with INTENTPROOF_SPEC_DIR, and adds a sync gate that fails when mirrored signing_* files under tests/fixtures differ from the spec golden copies.

^{Reviewed by Cursor Bugbot for commit bf59b99. Bugbot is set up for automated code reviews on this repo. Configure here.}