Add Level-1 document/part conformance track (B1b-1)

[gvonnessi]

Summary

• Extends the Level-1 fixture conformance track from the archive (container) layer to the document/part layer: a strict-JSON part loader reads the manifest and content parts out of the in-memory archive, and a mapper assigns the State Machine 5.4.2/5.4.3 load-time dispositions.
• Covers the draft/review + state-invariant part rows: duplicate keys in any part and non-representable hashed numbers (REJECT in every state); manifest absent / unparseable / malformed-field and off-enum state; major/minor version support; required/optional extension support (fail-closed); content-part presence and parseability (a present-but-unparseable content part REJECTs under 5.4.1 / 4.3.2).
• Reuses existing machinery rather than reinventing it: extracts validateManifestCore from projectManifest (which refuses pending-id drafts), a shared non-representable-number rule, and a shared verdict.ts resolver now backing both the container and document mappers.
• Adds 22 document fixtures (46 total; 245/245 conformance) with an independent Python oracle confirming all injected defects, 10 new errors.json codes, and a document capability. Zero runtime dependencies preserved.
• Out of scope (gated on trust material, land in B2/B3): the frozen/published INTEGRITY-ERROR ceilings and the document-ID / file-hash recompute.

Test plan

• tsc --noEmit + all 26 check:* gates + generate:template green locally (CI-parity)
• check:conformance 245/245 (199 vectors + 46 fixtures: 24 container + 22 document)
• check:document-oracle independently confirms every injected document defect
• Each new security-critical defense mutation-tested (dup-key any-part sweep, fail-closed extension, non-representable number, major-version, required-extension, content-unparseable) — disabling each fails the gate; reverted