Fix protected conformance producer resolution drift on main

[Copilot]

Protected client-v1 conformance runs were failing at phase1.stage.evidence-authority.checkout after main advanced past the producer revision reviewed by the SDK validator. The workflow now resolves omitted producer_revision inputs to the validator-reviewed Chat producer instead of implicitly validating the dispatch tip.

• Producer resolution

  • Default producer_revision to the producer commit recorded in the protected SDK validator lock.
  • Preserve the existing ancestry gate for explicit overrides: requested producer revisions must still be exact lowercase OIDs already merged into the dispatch ref.

• Validator trust checks

  • Load the validator lock from the protected validator revision when it is not already present locally.
  • Verify the protected validator revision remains reachable from OpenCoven/sdk main before accepting its reviewed producer commit.

• Workflow contract coverage

  • Extend the workflow test to assert the validator-bound default resolution path and the protected-validator ancestry check.
  • Refresh the conformance guide’s workflow metadata row and document the new default producer-selection behavior.

producer_revision:
  description: >
    Exact merged Chat commit to validate. Defaults to the validator's
    reviewed producer commit.

[BunsDev]

Closing: producer resolution is already explicit. #314 added the producer_revision dispatch input with an ancestry gate, and protected runs are dispatched with the revision the SDK validator binds (for example run 35566636457 with producer ac1c4f4). The failures these branches chase were a MAX_PATH overflow in aws-lc-sys on Windows, diagnosed on #219 (issuecomment-5757703171) and fixed in #348. Defaulting the producer from the SDK lock would also change a governed workflow outside the repin process.