Make "conformant" executable rather than self-attested, and stop the
machine-readable artifacts from silently drifting apart.

harness/ — a black-box conformance suite. Point it at any running AVP
server (`bun harness/conformance.ts --server URL`) and it drives the full
HTTP/JSON wire contract, asserting the normative MUSTs instead of just
printing a transcript:
- §3 auth: nonce shape, valid-token, single-use-nonce rejection, the
  classic "signed the base64 string not the raw nonce" rejection, 401
  without a token.
- §6 vault: createRepo sole-member/duplicate rules, pull unchanged vs
  envelope, push accept + version bump, a stale push as a 200 conflict
  (never a 4xx), non-member 403, addMember/fetchMemberKey, removed-member
  403.
- §4/§10 crypto + invariants: envelope round-trips to our plaintext; a
  second member unwraps and decrypts; zero-knowledge (the plaintext never
  appears in the server's JSON or stored ciphertext); removeMember bumps
  the epoch and a departed member's old key cannot decrypt the rotated
  envelope; a remaining member can.
The only AVP-specific code is the client crypto, reused from the
vector-tested examples/typescript/client, so the harness stays a thin
wire driver. Verified locally: 24/24 against the TypeScript reference
server.

.github/workflows/conformance.yml — runs the vector runner (which had no
CI until now), lints openapi.yaml with Spectral, checks schema/example/
index/openapi consistency, and runs the harness against the Go and
TypeScript reference servers (SHA-pinned actions, the interop workflow's
server-start/poll pattern).

examples/conformance — a new test asserts every examples/*.json body
validates against its schema $def, that vectors/index.json lists exactly
the vector files present, and that every openapi.yaml $ref resolves to a
schema $def (adds ajv + yaml dev-deps).

Cross-linked from README, IMPLEMENTING.md (§6 checklist), SPEC.md (§11),
llms.txt, and Taskfile.yml (`task harness`, `task openapi-lint`);
recorded under CHANGELOG [Unreleased].

CLAUDE.md rule: no em dashes. Replace the em dashes introduced with the
openapi/error/index/harness work (and one pre-existing in SPEC §6) with
commas, colons, semicolons, or parentheses. No semantic change.

Add openapi.yaml, the HTTP error body ($defs/Error), vectors/index.json,
the harness/ black-box suite, the Taskfile runner, and the conformance CI
workflow to the AI-agent mental model; list Go among the examples; extend
the "one protocol, keep in sync" note to cover openapi.yaml.