Enforce action-ref-v1 conformance and pin lab verification

[azender1]

This PR turns the lab finding into a reproducible SafeAgent check.

What changed:

• reject non-canonical action-ref-v1 timestamps before hashing, including epoch integers
• keep /claim/test unchanged; its 3-field dedup identity remains intentionally separate from action-ref
• fail closed in the attestation gate on an invalid action_ref_preimage
• route Mycelium trail derivation through the strict action-ref function
• add focused negative tests for epoch, second-precision, and microsecond-precision timestamps
• add a stdin/stdout conformance adapter
• run the Composable Evidence Criteria action-ref-conformance Action pinned at @v1 in CI

Motivation:
The lab's frozen neg-b01-epoch-integer vector exposed that SafeAgent previously hashed an integer timestamp instead of rejecting it at the grammar gate. The positive vectors already matched; this closes that negative-case gap and makes the claim continuously testable in CI.

This PR deliberately does not change /claim/test semantics because adding a per-call timestamp there would defeat its retry-dedup contract.