Update to UCP 2026-04-08 and cut a first stable release

[KristofersOzolinsMagebit]

The module targets UCP 2026-01-23 and has no stable tag.

Current state

• UniversalCommerceProtocolInterface::SPEC_VERSION = '2026-01-23'; latest certified upstream release is release/2026-04-08.
• composer.json is at 0.0.1 and depends on magebitcom/ucp-php-spec: ^1.0.1, which is itself three releases behind (Update to UCP 2026-04-08 and cut a first stable release ucp-php-spec#1).
• The module currently returns HTTP 500 on every checkout endpoint — three unrelated fatals. Official conformance suite scores 0 passing / 41 failing / 11 skipped.

Asks

1. Fix the fatals so the endpoints respond at all.
2. Migrate to 2026-04-08 once ucp-php-spec is regenerated. Main breaking changes: totals becomes a constrained array (exactly one subtotal, one total), the discount sign convention flips to strictly negative, total.type loses its enum (so the generated TYPE_* constants disappear and etc/di.xml breaks at DI-compile), and extension $defs keys move to reverse-domain names.
3. Pin upstream by commit SHA — release/2026-04-08 received commits until 2026-05-22, so the date alone is ambiguous.
4. Add a test baseline before the migration. There are currently no tests, and the discount sign flip is mutually exclusive with the current behaviour — it will silently corrupt money without one.
5. Tag a first stable release once checkout + discount pass conformance.