Vendor the exercised SCXML fixture subset

[JovaniPink]

Summary

• remove the vulnerable 2018 SCXML Test Framework submodule and its unused Node/Grunt dependency graph
• vendor only the 53 SCXML/JSON fixture pairs exercised by Python tests
• retain the Apache 2.0 license, upstream URL, and exact source commit b46a10a1c3a3b1ca5c5cb4bb44ddb5c785611f41
• add an exact fixture inventory and provenance guard to the hosted SCXML smoke gate
• update development and conformance documentation
• pin every GitHub Action plus the maintained devcontainer base and Poetry 2.4.1
• add Renovate coverage for immutable refs

Boundary

This branch is based on exact master commit 94674b25f031979dee912d50121eebaa44ae593f. Vendored fixture bytes are unchanged from the pinned upstream commit. The JavaScript runner, package manifest, lockfile, and unused cases are intentionally excluded. Runtime library behavior is unchanged.

Validation

• 106 fixture files compared byte-for-byte with the pinned submodule source
• canonical release preflight passed:
  • package metadata/lock check
  • 417 primary tests
  • 55 SCXML smoke checks: 54 conformance cases plus the exact inventory/provenance guard
  • Ruff format and lint
  • mypy across 22 source files
  • sdist and wheel build
  • installed-wheel smoke
• pinned devcontainer build passed and installed Poetry 2.4.1
• offline OSV Scanner 2.5.0: 15 Poetry-lock packages, clean
• JSON, YAML, and staged-diff integrity checks

Review focus

• completeness of the 53-case fixture inventory
• Apache license and commit provenance
• removal of all submodule checkout paths
• devcontainer modernization

Rollback is a single revert of c3fe29fcf57847f103613781c35eccd33831343c.