feat: build a typed Sallyport acceptance fixture

[zsumz]

What changed

• replaces the one-line JavaScript fixture with strict TypeScript, compiled ESM, and declarations
• typechecks and executes a clean consumer against the exact candidate tarball
• adds Rubric linting, Vitest, 100% source coverage, an exact package allowlist, and a multi-runtime CI matrix
• documents public canaries, rejection drills, and durable acceptance evidence
• regenerates the caller with Sallyport 0.1.0 at workflow checkpoint 5f5a83fb553b6e408dff0bd1759ca8abe51e0e6b

Why

The previous repository proved only one older staging checkpoint. It did not
carry Sallyport's current protocol pin, a typed downstream contract, durable
disposition evidence, or the quality gates used across the surrounding zsumz
projects.

Impact

sallytest remains intentionally tiny and should not be used as an application
dependency. The prepared 0.0.2-fixture.0 canary will publish only under the
fixture dist-tag after the protected branch, npm 2FA, and Sallyport
finalization gates are satisfied.

Validation

• npm ci --ignore-scripts
• actionlint
• npm run release:check
• npm pack --json
• exact-tarball npm run release:smoke
• all three commits verified as OpenPGP-signed by zsumz <shawn@zsumz.com>