Standardize Commons v1.1.0: receipt-first contract, remove legacy x402 entry, and make TS tests package-local

[GsCommand]

Motivation

• Make the repository present one clear public story for Protocol-Commons v1.1.0: the canonical public envelope is { receipt, runtime_metadata? } with receipt as the signed artifact and runtime_metadata optional and unsigned.
• Eliminate remaining x402-first wording and SDK request shaping that implied commercial/x402-first positioning so docs, examples, fixtures, and client code are consistent and Commons-first.
• Ensure the TypeScript package test flow is reproducible from this repo alone and separate cross-repo/integration checks into an explicit optional lane.

Description

• Documentation: unified root and package docs to describe the canonical contract (receipt signed, runtime_metadata unsigned) and clarified that receipt.x402 is protocol metadata (not a first-class commercial surface); updated README.md, QUICKSTART.md, EXAMPLES.md, DEVELOPER_EXPERIENCE.md, DEPLOYMENT_GUIDE.md, RELEASE_GUIDE.md, MAINTAINER_GUIDE.md, typescript-sdk/README.md, and python-sdk/README.md.
• SDK request shaping: removed the legacy x402://... entry construction from both SDKs so client payloads include receipt.x402 verb/version metadata only (files changed: typescript-sdk/src/index.ts, python-sdk/commandlayer/client.py).
• Fixtures and vectors: regenerated/updated shared test vectors and verification metadata (public key and expected hash) to match the canonical unsigned/signed flow in test_vectors/ (files changed: receipt_valid.json, receipt_valid_v1.json, receipt_invalid_sig.json, receipt_wrong_kid.json, receipt_malformed_pubkey.json, public_key_base64.txt, expected_hash.txt, and test_vectors/README.md).
• Tests / scripts: made the TypeScript package npm test package-local by removing the automatic cross-repo runtime tests and adding an explicit optional integration script npm run test:integration; updated typescript-sdk/package.json, typescript-sdk/scripts/unit-tests.mjs, and typescript-sdk/README.md to document the reproducible workflow.
• Compatibility posture: left legacy normalization logic in place (both SDKs still accept older blended envelopes and normalize trace -> runtime_metadata), but made it explicit in docs that this is compatibility-only and not the canonical public contract (normalization code left intact: typescript-sdk/src/index.ts normalization and python-sdk/commandlayer/client.py normalization behavior unchanged).

Testing

• Ran the Python unit suite with python -m pytest in python-sdk and observed all tests pass (23 passed, 1 warning).
• Verified repository consistency with rg searches to ensure x402:// literal is no longer present in public/examples and that docs now consistently state the canonical { receipt, runtime_metadata? } model; these checks returned no remaining x402:// occurrences.
• Ran git diff --check to ensure no whitespace/patch issues and confirmed diffs are clean.
• Attempted to run the TypeScript npm test flow but the build toolchain (tsup) was not available in this execution environment so full npm test could not be completed here; to address reproducibility the package now documents npm test as package-local and provides npm run test:integration for the optional cross-repo runtime checks.

If desired next steps: run cd typescript-sdk && npm ci && npm test in a provisioned Node/npm environment to validate the TypeScript package-local tests before tagging the release.

---

Codex Task