conformance: implement content index and undeclared-state checks, corpus rc.48

[samjanny]

Summary

Updates the bundled corpus to rc.48 (88 -> 108 vectors) and closes the two in-scope conformance gaps reported in #4. The conformance suite goes to 106 passing with the two Stage 7 trust vectors reported as out of scope rather than counted as failures.

Changes

State undeclared (vectors 220-221)

DocumentSchema.checkStateUpdatesDeclared cross-checks each transaction state_updates (namespace, key) against the state_policy declared by the manifest under which the transaction is verified, raising E_STATE_UNDECLARED for an undeclared reference. The pipeline reads the policy from the pinned manifest in the publisher history and runs the check after signature verification. The standalone Stage 5 operation-form and hard-range checks are unchanged; this is the policy-relative half that needs the manifest.

Content index (vectors 230-235)

New Stage9ContentIndex implements the Stage 9b flow that was previously absent:

• Hash-check the served /content_index.json against the manifest content_root (E_CONTENT_INDEX_HASH_MISMATCH).
• Structurally validate the closed index schema {"entries": {"/path": {"seq": N, "hash": "sha-256:..."}}} (E_CONTENT_INDEX_INVALID).
• Compare a content document seq and response-body hash against the committed entry for its path (E_CONTENT_SEQ_MISSING, E_CONTENT_SEQ_ROLLBACK, E_CONTENT_SEQ_UNCOMMITTED, E_CONTENT_HASH_MISMATCH).

E_CONTENT_INDEX_FETCH_FAILED is a transport failure of the index fetch and is not exercised by the corpus. The harness loads the served index and content_root from the vector context.

Corpus bump and trust out of scope

• Bundled corpus replaced with the rc.48 revision (108 vectors).
• SPEC_REVISION and the SmokeTest assertion bumped to 1.0-rc.48.
• ConformanceTest now asserts the corpus rc_target matches SPEC_REVISION, so a corpus bump and a code bump cannot drift apart.
• The Stage 7 trust-state machine remains unimplemented, so vectors 210-211 are listed in an explicit out-of-scope set and reported with a printed count rather than silently passing.

Verification

JDK 21.

• mvn test: 168 tests, 0 failures (all unit suites plus conformance)
• mvn test -Dtest=ConformanceTest: 106 run, 0 failures, 2 skipped as out of scope

The bundled corpus matches the canonical rc.48 corpus at the spec repo byte for byte.