Tighten public release surface: remove stale script, add integrator guide, release draft, expand examples, regen checksums

[GsCommand]

Motivation

• Eliminate a visible repo-state contradiction where package.json advertised a scripts/ajv-run.mjs entry that did not exist and make the public script surface coherent for integrators.
• Improve the implementer onboarding/consumption surface so external users can verify canonical schemas, checksum scope, and provenance without maintainer help.
• Provide a first-class release artifact draft and broader example coverage to increase external trust in the published v1.1.0 line.

Description

• Removed the stale validate:schema entry from package.json so the published scripts map matches the actual scripts/ directory and left the canonical validation scripts: validate:schemas, validate:examples, validate:integrity, validate:all, validate, and generate:checksums.
• Added an implementer-focused INTEGRATOR.md, a GitHub-release-ready releases/v1.1.0.md, and expanded README.md and ONBOARDING.md with an Integrator quickstart, explicit checksum/provenance guidance, and publication steps.
• Expanded example coverage by adding alternate valid request fixtures for each verb under examples/v1.1.0/commercial/*/valid/002-* (authorize, checkout, purchase, ship, verify) and normalized example governance (removed/declared ts/ as non-authoritative).
• Regenerated and committed checksums.txt to include the expanded artifact set and ensured manifest.json, schemas/v1.1.0/index.json, and the examples tree remain consistent with the current canonical line.

Testing

• Ran npm run validate (which executes validate:schemas, validate:examples, and validate:integrity) and all validation checks passed for schema and example consistency.
• Ran npm run generate:checksums which wrote the updated checksum ledger for the checksum-covered payload and then ran npm run validate:integrity which validated checksum scope and hashes successfully.
• Ran sha256sum -c checksums.txt and verified all listed files matched their recorded hashes.
• Note: npm install failed in this environment due to a registry 403 Forbidden, but an existing node_modules allowed the validation and integrity checks to run and succeed.

---

Codex Task