Create Context Builder conformance, security and reference test suite

[andrewperis]

Parent epic: #5

Summary

Create Context Builder conformance, security and reference test suite for Context Builder v1.

Ownership and dependencies

• Repositories: platform; codex synthetic contract conformance fixtures.
• Depends on: Create Context Builder CLI and authoring/review workflow #84.
• Baseline: released Prompt SDK v1.0.0 and Context Package v1.0.0; do not change immutable contract bytes.

Scope and deliverables

• Consolidate contract, authorization, adapter, normalization, ranking, budget, lifecycle, provenance and SDK integration coverage into a reusable suite.
• Add reference scenarios for public canon, approved synthetic private exports, mixed classification, conflicting continuity, incomplete context and deterministic replay.
• Test hostile embedded instructions, unauthorized source reads, traversal, identity tampering, expiry/revocation, cache isolation, malformed JSON, budget exhaustion and redaction.
• Add reviewed golden fixtures and CI on supported Node versions, with no paid/model/private-network calls by default.

Acceptance criteria

• Source adapters and policy verifiers can run common conformance tests with offline fakes.
• Every core contract and security boundary has positive and negative coverage with an explicit coverage map.
• Golden changes require review and test runs never rewrite them; fixtures are safe for their repository visibility.
• CI passes with no secrets or real private content and demonstrates complete package-to-Prompt-SDK flows.

Implementation guardrails

Follow Constitution v1.0.0 at a9cc8a503aa30e17820edc62ac95f7cbe10e0564 and repository boundaries. Add focused tests with implementation; the suite task consolidates rather than postpones testing. Public issues, fixtures and docs use synthetic/already-public material only. Approved private inputs stay behind explicit secure artifact boundaries. No direct Lore checkout, silent declassification, self-approval or canon promotion.