Run conformance against the upstream OKF sample bundles

[leoafarias]

Summary

test/conformance_test.dart covers synthetic OKF 0.2 §11 cases built in memory against the pinned revision 3fcbb9f. It never loads the bundles upstream ships, so it could not detect spec drift such as knowledge-catalog#323 or real-bundle cases the synthetic tests miss.

Current okf 0.3.0 results (through Wayfinder 0.0.3) against knowledge-catalog at a430739:

Upstream bundle	Result	Findings
okf/bundles/ga4	PASS	none
okf/bundles/stackoverflow	PASS	none
okf/bundles/crypto_bitcoin	PASS	none
okf/bundles/acme_retail	FAIL	error okf/invalid-log-frontmatter (its log.md has YAML frontmatter), plus invalid-stale-after and invalid-usage-window advisories caused by the timestamp change

The okf/samples/* directories fail only because their README.md files have no frontmatter. They look like source material rather than bundles.

Proposal

• Fetch or vendor upstream okf/bundles at a pinned commit and assert an expected result per bundle: the verdict and finding IDs. That gives an upgrade gate.
• Add a scheduled job against upstream main that reports drift without failing releases.
• Exclude okf/samples, or record why it isn't a bundle.
• The acme_retail log.md case depends on knowledge-catalog#286, which asks whether log.md may have frontmatter. Record it as a known difference until the spec decides.

Related: #56 (the timestamp spec change) and #57 (strict timestamp parsing).