Add a neutral reader conformance corpus and encryption KATs

[tuki0918]

Summary

The shared format fixture currently records constants, but it does not provide a language-neutral oracle for complete reader behavior or cryptographic known-answer tests. Swift and C# mainly compare constants and exchange a small ASCII payload plus NFC-equivalent passwords.

Impact

Implementation differences can reach releases without a deterministic fixture stating whether a package must be accepted, which error category is expected, or which semantic result should be returned. A future third implementation could accidentally become a new de facto specification.

Evidence

• Fixtures/FormatV1.json:1-32
• macOS/Tests/EndToEndSmoke.FormatContract.swift:46-140
• Windows/BundlePack.Core.Tests/FormatContractExpectations.cs:17-84
• macOS/Scripts/GenerateCompatibilityFixtures.swift:15-80
• Windows/BundlePack.Core.Tests/Program.cs:34-106,341-347
• .github/workflows/ci.yml:17-80

Proposed change

• Add Fixtures/Conformance/ with positive and negative cases.
• Give each case a stable expected result: accept or error category plus semantic inspection data.
• Add deterministic encryption KATs containing password bytes after NFC, salt, nonce prefix, header, AAD, plaintext, ciphertext, and tag.
• Cover chunk boundaries at minimum accepted size and canonical 4 MiB size.
• Add one-bit mutation, truncation, append, header-field, ciphertext, and tag cases.
• Run the same corpus in Swift and C# CI.

Acceptance criteria

• Every fixture has source SHA-256 and expected.json.
• Error message prose is not an oracle; stable categories are.
• Swift and C# return the same accept/reject and semantic result.
• A public-icon-plus-hash replacement is accepted only as locked public data and fails full unlock authentication.
• Same plaintext sealed twice produces different salt/nonce/ciphertext and both results decrypt successfully.
• CI artifacts retain a minimized failing fixture on mismatch.

Compatibility constraints

Do not change the current encrypted byte layout, NFC password rule, PBKDF2-HMAC-SHA256, AES-256-GCM nonce/AAD/tag contract, unknown-field tolerance for known manifest versions, or the rule that wrong password and tampering share one public error category.