feat: make the conformance checker one installable command

[tactino]

The checker that grades a client against SPEC.md existed already and was good. Running it was the problem.

What it took before

From the documentation, verbatim:

uv run --with websockets examples/conformance_server.py --port 8000 --steps 20 &
/tmp/plugrl_client 127.0.0.1 8000 20

Three things wrong with that for somebody outside this project:

• --with websockets, because the checker imported a library the package never declared. A fresh uv sync could not run it.
• A path into a checkout. Not a command, so not something a reader can install and use on their own client.
• A race. The client starts whether or not the socket is listening yet. CI works around it with a hand-rolled wait loop, copied into three jobs.

What it takes now

uv run --extra conformance plugrl-conformance \
    --port 8000 --steps 20 --client "./my_client 127.0.0.1 8000 20"

• websockets is declared, as a conformance extra.
• plugrl-conformance is a console script; the implementation moved to plugrl_protocol.conformance, which also removes the sys.path insert it needed to import the real codec from examples/.
• --client starts the client after the socket is listening and waits for it afterwards. A non-zero exit from the client is reported as a failure of its own, rather than surfacing as "no client ever finished".

Without --client it waits for a client started elsewhere, exactly as before.

examples/conformance_server.py still works

It is now a five-line shim, kept deliberately: E2 and E7 both quote python examples/conformance_server.py ... as the command they ran. A published record that points at a file which no longer exists is worth less than the shim. It keeps the sys.path insert so a fresh checkout still runs without installing anything, which is how those commands were run.

Verified: both forms produce the same report and exit 0 against raw_client.py.

CI

The three conformance jobs lose their wait loops. One of them pipes to tee to grep the client's output; that now has set -o pipefail above it, because without it a failing check would have been masked by tee's exit status. That was true of the original too.

uv run pytest -q: 30 passed.