Adopt the conformance-fixtures wire contract for records

[cuibonobo]

Summary

@haverstack/conformance-fixtures is now published (core#167 cleared). This issue's text named two work items (PATCH body shape, /migrate), but reading the actual fixture data (createRecordFixtures, patchContentFixtures, deleteRecordFixtures/undeleteRecordFixtures, associateFixtures/dissociateFixtures, setPermissionsFixtures, errorResponseFixtures, queryRecordsFixtures, commitMigrationFixtures) turned up a much larger set of divergences in the records route surface. Fixed all of them:

• POST /records accepts a full record body, not just {typeId, content}. id is client-minted (12 lowercase Crockford base-32 characters, no reserved _ prefix) and optional — forwarded to ScopedStack.create()'s opts.id, which generates one when omitted. createdAt/updatedAt/version are never accepted from the client, same treatment as entityId/principalId. Returns 200, not 201 — matches every other write in this API.
• PATCH /records/:id: the body IS the content patch (RFC 7396), never an envelope. Real wire-dishonesty bug: a conforming client's {"title": "New"} read as body.content (undefined) and silently no-opped while still bumping version. Also wires up If-Match → ifVersion for optimistic concurrency (412 version_conflict on mismatch).
• Added POST /records/:id/undelete — had no wire endpoint at all.
• Added POST /records/:id/migrate — owner-acting-alone only (per ScopedStack.commitMigration()'s own doc comment, added in core 0.10.0), body {toTypeId, content}, validates toTypeId is registered, leaves a pre-migration snapshot.
• Moved association removal from DELETE /:id/associations (a body-bearing DELETE — undefined semantics per RFC 9110 §9.3.5) to POST /:id/associations/delete.
• PUT /:id/permissions now returns 204 with no body, instead of echoing the permissions back at 200.
• Verified, no code changes needed: malformed/unknown-sort-field cursors → 400 bad_request; reserved content keys (__proto__ etc.) on PATCH → 422; payload-too-large record bodies → 413; omitting limit → one default-sized page (50), never everything.
• Id-format validation (malformed charset, wrong length, reserved _ prefix) now correctly returns 400 bad_request — was 422 validation in core 0.9.0, fixed upstream in 0.10.0.

Core update

Bumped @haverstack/core to ^0.10.0, @haverstack/adapter-local to ^0.8.0, and @haverstack/wire-types to ^0.8.0 — all now consistently on core ^0.10.0, so no pnpm.overrides pin is needed. (Briefly was: bumping core alone broke error serialization repo-wide, since wire-types' then-published version still resolved core ^0.9.0 via its workspace:^ snapshot from its last release, producing two separate installed copies of @haverstack/core and silently-failing instanceof checks in serializeError(). Fixed properly once wire-types republished rather than carrying the override.)

Two other stale-core paths remain in the dependency tree (blob-adapter-disk@0.7.0, transitive via adapter-local, still on core ^0.9.0; conformance-fixtures@0.1.0 pulls in an old wire-types too) but neither matters in practice — verified the full suite passes clean, including every attachment test exercising blob-adapter-disk, and conformance-fixtures is dev-only with no runtime interaction. Not overridden preemptively for a problem that isn't actually occurring.

Also adopted @haverstack/conformance-fixtures as a dev dependency for reference, though the tests here are hand-written per the codebase's existing style rather than a generic fixture-iterating harness.

Test plan

• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm test — 167/167 passing. Covers: client-minted id (success, generated-when-omitted, three malformed cases → 400, duplicate → 409), If-Match/412 concurrency, POST /:id/undelete (success, idempotency, 403, 404), POST /:id/migrate (success, 403 non-owner, 401, unregistered toTypeId, schema failure, 404, pre-migration snapshot), PUT/GET /:id/permissions (previously untested), reserved content keys via PATCH, pagination defaults, malformed/unknown-sort-field cursors, oversized record body → 413.