ci: validate README cover assets efficiently

[NWYLZW]

Summary

This bounded CI change adds an efficient README cover-assets path while keeping the reviewed trust boundaries explicit.

• The docs-assets path is atomic: generator plus all four cover assets is allowed, or README-only is allowed.
• Validation uses real Markdown/DOM parsing, strict generator/SVG checks, and full bounded JPEG decoding.
• There is no deterministic visual provenance claim. Normal human PR visual review is required for all four cover variants.
• Changes to package files, the lockfile, the workflow, and the validator remain full-scope and evidence-ineligible.
• The required Avatar SDK CI / build-test-pack job and the Deploy exact-source invariant are unchanged.

Verification

• Reviewed base: 9cb19eca28b7b9c3e622c038196f6ce170e46640
• Exact reviewed paths: .github/workflows/sdk-ci.yml, __tests__/sdkCiWorkflow.spec.ts, package.json, pnpm-lock.yaml, scripts/validate-readme-cover-assets.mjs
• Exact review result: third independent review APPROVE; P0-P3 none. The candidate passed 34 relevant tests, frozen install, Node/YAML/typecheck/diff checks. Two request-changes rounds were fixed before final approval.
• Canonical binary diff SHA-256: 22fced2e18c2348514ac81677b74114f6f80816eb922efe2ef310d4728ed4e0f

Experience Review

Normal human PR visual review remains required for the four cover variants; this PR does not claim deterministic visual provenance.