v1.2.3 — the normalization corpus is fetched, not vendored

v1.2.2 added the normalization corpus but shipped a copy of it. A copy passes forever against whatever it was copied at, which is precisely the staleness the corpus exists to prevent: it is the artifact holding four independent implementations of SPEC.md section 2 to one reading of a document, so a stale copy is worse than no copy at all.

The corpus is now fetched from intentspec.org/normalization-corpus.json at test time, alongside the existing schema and anchors drift checks.

The split that matters

Data is fetched. Code stays vendored. corpus-compare.mjs is copied and reviewed rather than fetched, because pulling executable code into a test at runtime is a supply-chain hole, not a freshness fix.

A fetch failure fails loudly and is skipped only under SKIP_DRIFT=1, so a site outage never reads as conformance.

Usage is unchanged: uses: pathmodeio/validate-intentspec-action@v1