Align conformance producer revision with protected validator lock

[Copilot]

platform-conformance (win32-x64) was failing in phase1.stage.evidence-authority.checkout because the workflow defaulted producer selection to the dispatch tip, which can diverge from the protected validator lock’s expected evidenceProducer.commit. This change makes producer resolution lock-driven by default and keeps protected revision checks explicit.

• Producer revision resolution (workflow hardening)

  • In producer-revision, when inputs.producer_revision is omitted, resolve from:
    • .phase1-counterparts/sdk-validator/conformance/client-v1-cross-repository-lock.json
    • evidenceProducer.commit
  • Keep the existing ancestor gate against github.sha so only merged commits are accepted.

• Protected validator consistency gate

  • Require inputs.validator_revision to exactly match vars.CLIENT_V1_CONFORMANCE_VALIDATOR_REVISION before deriving defaults.
  • Improve failure messages to clearly distinguish:
    • invalid validator input format
    • validator input/protected mismatch
    • missing/invalid validator lock JSON
    • missing/invalid evidenceProducer.commit

• Contract/test/docs synchronization

  • Update workflow tests to reflect lock-driven default behavior and mismatch rejection path.
  • Refresh conformance documentation metadata entry for .github/workflows/client-v1-conformance.yml (size/SHA row) to match committed bytes.

# producer-revision (simplified)
requested="${OPENCOVEN_PRODUCER_REVISION_INPUT:-}"
if [ -z "$requested" ]; then
  # require validator input == protected validator revision
  # then read lock.evidenceProducer.commit from protected sdk-validator checkout
  requested="$(node --input-type=module --eval '...read lock...; process.stdout.write(commit)')"
fi
git merge-base --is-ancestor "$requested" "$OPENCOVEN_DISPATCH_SHA"

[BunsDev]

Closing: producer resolution is already explicit. #314 added the producer_revision dispatch input with an ancestry gate, and protected runs are dispatched with the revision the SDK validator binds (for example run 35566636457 with producer ac1c4f4). The failures these branches chase were a MAX_PATH overflow in aws-lc-sys on Windows, diagnosed on #219 (issuecomment-5757703171) and fixed in #348. Defaulting the producer from the SDK lock would also change a governed workflow outside the repin process.