baton-spec moves to d5c8016, where user_id is principal_id. The submodule was
still at d5e25ea, so the conformance test validated against the old field
name, and the rename in 0.6.8 could not have failed it.

The stdio scenario resolves no principal, so the identity field never reached
the validation. The scenario test now also drives the Emitter with a Principal
and an HMAC key, as baton-extmcp does, and validates the hashed event it
writes. It stays in that test rather than a third one: try/SECURITY.md §8
counts the two tests that skip without the submodule, and test_try_kit.py
pins the count.

Verified: the conformance tests ran (2 passed; they had been skipping with
the submodule unchecked out), and serializing the field as user_id reds them.
Full suite passed, ruff clean.