spec: Go conformance adapter for go/cmd/conformance

[awbx]

Split off from #6. The TypeScript adapter shipped as the reference; this issue tracks the Go counterpart so the runner can validate both SDKs and prove the cross-language contract is upheld byte-for-byte.

What ships

• go/cmd/conformance-adapter/main.go implementing the three subcommands from spec/conformance/README.md: manifest-canonicalize, auth-sign, auth-verify. Wraps the internal/manifest and internal/auth library APIs directly.
• A second matrix entry in the existing conformance CI job that runs the runner against the Go adapter alongside the TS one:

  - go run ./cmd/conformance --adapter "go run ./cmd/conformance-adapter"
  

• README update under ## Conformant adapters noting Go as shipping.

Acceptance criteria

• All 64 vectors (currently in spec/manifest-vectors.json + spec/auth-vectors.json) pass against the Go adapter.
• Conformance CI job runs both TS and Go adapters and fails if either reports a fail.
• If a new vector lands, both adapters must pass it before the vector PR can merge (the existing Conformance check enforces this for TS; this issue extends to Go).

Reference

See ts/packages/sdk/test/conformance-adapter.mjs shipped in #6. ~80 LOC; the Go version is similar.