test: prove standalone Kertas runtime conformance

[wms2537]

Closes #53

Outcome

Proves a Kertas-shaped integration against an independently deployed runtime using only authenticated public HTTP and immutable digest-bearing references.

Acceptance coverage

• standalone @straits-ai/kertas-runtime-contract-client has no runtime-store, migration, scheduler, harness, or test imports
• discovers and validates published contract documents before use
• exercises active kertas.runtime/v1alpha1 and supported run-as-session/v1 compatibility modes
• creates a ManagedSession, delivers a future event, observes ordered session and Run events, and reads Runs, artifacts, and bounded child-result projections
• verifies cross-tenant Session and Run reads return 404
• runs API, worker, PostgreSQL, and compiled client in separate containers on an isolated Docker network using a non-loopback service endpoint
• records runtime completion only as execution disposition; Kertas Outcome and Release decisions remain unset
• retains a redacted receipt bound to exact server/client commits, image config digest, contract versions, immutable snapshot digest, and verified cleanup
• makes the public-client boundary part of the controlled-alpha gate and the deployment conformance part of PR/main and tag-release workflows

Verification

• exact commit: 686582578a87eb2d6bba2e607b91fe75906db059
• full repository suite is covered by the exact-commit release gate
• focused public-client, compatibility, and artifact tests: 4 files / 12 tests PASS
• npm run kertas:boundary: PASS
• npm run container:smoke (including standalone Kertas conformance): PASS
• local conformance image config digest: sha256:b67571696b10f04cbd42a766d71af5123ae5cdc879c25a87e05edd2b43a0ecca
• digest-bound receipt: release-evidence/kertas-conformance/kertas-conformance-summary.json
• npm run release:gate: PASS
• release-gate evidence: release-evidence/2026-07-22T08-54-03-512Z
• independent specification review: PASS on the exact commit
• independent standards review: PASS on the exact commit after rebuilding and rerunning Docker conformance