Route conformance backend through Host proxy

[lucarlig]

Summary

• Route the conformance fixture through a small HTTP proxy so every request reaches the fixture backend with the expected Host value, including stateless tools/call requests.
• Keep the pinned JavaScript fixture unchanged.
• Separate dataplane-owned expected failures from failures reproduced directly against the pinned fixture.
• Make conformance failures actionable: CI now prints the exact actual-versus-baseline difference, includes each unexpected result's status and error message, emits GitHub error annotations, and writes the comparison to the job summary.

Pinned fixture baseline

Running the official conformance runner directly against the pinned alpha.11 TypeScript fixture produces:

• 129 passed and 54 failed, plus one scored warning.
• 47 failures are extension or pending scenarios and are already unscored by the requirements file.
• The remaining seven scored failures are tools/call wire-schema checks.
• The scored warning is input-required-result-validate-input:sep-2322-validate-input-responses.

Those eight fixture-owned findings are documented separately in tests/conformance/upstream-fixture-failures.yml; they do not hide dataplane regressions.

Validation

• Full signed-commit hooks passed.
• Focused retry of the transient gateway_list_tools test passed (1/1).
• shellcheck tests/conformance/report-baseline-diff.sh
• actionlint
• mdbook build _context/wiki
• mdbook test _context/wiki
• Reporter validated against both the direct fixture results (8/8 matched) and the dataplane results (44/44 matched).
• No Rust changes and no fixture patches.

[cafalchio]

LGTM