Port record_hash and RecordAttestation to the TypeScript, Python, and Go SDKs

[macanderson]

Problem

PR #114 implements record_hash (RFC 8785 JCS plus the omit-self rule) and
RecordAttestation (detached Ed25519) in contextgraph-types and publishes
golden vectors in tests/fixtures/. No SDK implements either, so the vectors'
whole reason for existing — that an implementation in another language can
reconcile to the same bytes — is unproven by anything that runs.

schema/validate-examples.py checks two properties of the vectors in Python
(the canonical text hashes to the published digest, and parses back to the
fixture minus record_hash). Neither is a JCS implementation, and the file
says so.

This is the record-layer sibling of #93, which tracks porting provenance
attestation to the SDKs. The two are separate ports with different preimages
and can land independently.

Files

• tests/fixtures/record-hash-vectors.json — the canonical JCS text and hash of
  every record fixture
• tests/fixtures/record-attestation.json — a real Ed25519 signature
• tests/fixtures/record-attestation-key.json — the published test key, public
  key, and the exact signed message
• contextgraph-types/src/record_attest.rs — the reference implementation
• contextgraph-types/tests/record_vectors.rs — the same vectors inline
• docs/profiles/context-exchange-provider.md — LH1, LH2, LH5, LC4, LC5
• docs/adr/0012-record-hash-and-record-attestation.md
• sdk/typescript/, sdk/python/, sdk/go/

What "done" needs

Per SDK:

1. A recordHash / record_hash / RecordHash that canonicalizes with a
   conforming RFC 8785 implementation and applies the omit-self rule (remove the
   top-level record_hash member only).
2. RecordAttestation verification over the domain-separated message
   ("contextgraph/attest/1/record" followed by the digest's 32 raw bytes,
   profile LC4), recomputing the record's hash rather than reading the stored
   member (LC5).
3. A test that reads tests/fixtures/record-hash-vectors.json and asserts the
   SDK reproduces each jcs_utf8 and each record_hash, plus one that
   verifies record-attestation.json under record-attestation-key.json's
   public key.
4. A CI job in .github/workflows/ci.yml running it, alongside the existing
   per-SDK conformance jobs.

Note for whoever picks this up: JavaScript gets ECMAScript number semantics for
free, Python and Go do not. Python's repr and Go's strconv.FormatFloat
differ from Number::toString at the exponent thresholds RFC 8785 Appendix B
pins — that table is the first thing to test against, not the last.

Done

Each SDK reproduces every published vector, verifies the published attestation,
and a CI job proves it on every PR.