Read signing golden fixtures from spec checkout - #64

PR Summary

Medium Risk
Changes how signing conformance is validated in CI and ties releases to an external spec repo/branch fallback, but does not alter runtime signing logic in the SDK.

Overview
Signing golden tests now read fixtures from INTENTPROOF_SPEC_DIR/golden/sdk-signing when that env var is set, and otherwise keep using tests/fixtures for local runs.

CI checks out IntentProof/intentproof-spec, falls back to phase3-ecosystem-conformance if golden/sdk-signing is missing on main, runs coverage with INTENTPROOF_SPEC_DIR, and adds a sync gate that fails when mirrored signing_* files under tests/fixtures differ from the spec golden copies.

^{Reviewed by Cursor Bugbot for commit bf59b99. Bugbot is set up for automated code reviews on this repo. Configure here.}