Conformance test suite + CI + malformed-point decode vectors (fixes #85)

[liqdmetal]

Summary

Executable conformance suite for the DERO transaction relation + CI + malformed-point decode vectors. Tests-only (no consensus change, no production code touched).

What's in it

Test	What it verifies
TestConformance_ValidProof	deterministic NORMAL ring-16 tx, proof verifies end-to-end
TestConformance_MutationsRejected	11 byte-mutations across header/statement/proof all rejected
TestConformance_RingSizeMatrix	build+verify+round-trip across ringsizes 2..128
TestG2P0_SameIndexAttack	adversarial self-send (same ring index) rejection
TestG2P0_FakeReceiverMutation	fake-receiver statement-region flips rejected
TestK0_RingSize2IsIdentifiable	regression marker for the ringsize-2 signer-exposure finding
TestConformance_Determinism	statement/txid byte-determinism
TestConformance_MalformedPointDecode	compressed-point decode behavior for x≥p, non-residue, bad-flag inputs

The malformed-point vectors (why they matter)

A Rust differential harness (clean-room reimplementation, differentially tested against this codebase) found that bn256/changes.go discards the on-curve error when x >= p — Go "succeeds" with an invalid point while a strict decoder rejects. This is a chain-split class bug if a contract ever stores a malformed point (commitments, point-arithmetic outputs). The vectors pin both implementations: the assertion is determinism-only (no panic, same result per call) so Go and a strict Rust decoder can converge on the exact accept/reject rule.

Confirmed live by the vectors: x_gt_p and bad_flag inputs currently decode with err = nil in Go.

CI

.github/workflows/build-and-test.yml — builds the tree + runs the conformance, DVM-intrinsic, and K0 suites on Go 1.25. The tree needs -mod=mod (the released vendor/ is incomplete — no vendor/modules.txt); go.mod pins the jrpc2/readline versions that actually provide the APIs the code uses.

Note on CI: GitHub only executes workflows present on the default branch (community-dev). This workflow ships in this PR but won't run on these PRs until it's on the default branch — the vectors here are the durable correctness oracle regardless.

Relationship to the other PRs

This is the "Submission C" conformance piece from the K0/DVM program. It strengthens the whole set:

• K0 privacy package: eliminate ringsize-2 (fixes #120) #121 (K0 package) — the ringsize-matrix + K0 regression vectors
• DVM intrinsics: verification + group-arithmetic primitives (verify_sig, commitments, ec_add, ec_mul, verify_adaptor) (fixes #127) #128 (DVM intrinsics) — malformed-point vectors cover the commitment/point inputs the new intrinsics accept

---

Branch: feature/conformance-suite in the fork liqdmetal/derohe-improvements-by-liqdmetal. Flat on community-dev.

[liqdmetal]

Part of the K0/DVM package — this is Submission C (conformance). Strengthens #80 (Fix A, K0 marker), #82 (Fix B1, ring matrix), #84 (DVM v9, malformed-point inputs). See the related-PRs table in those PRs.