Add CI to run the OABP conformance suite on every PR

[Aigen-Protocol]

CONTRIBUTING tells contributors to run cd sdk/python && python3 -m pytest tests/, but there's no .github/workflows/ — nothing enforces it on PRs. Let's wire it up.

Scope

• Add .github/workflows/conformance.yml: on push + pull_request, set up Python 3.12, run cd sdk/python && python3 -m pytest tests/.
• The conformance tests live at sdk/python/tests/test_oabp_conformance.py (stdlib-only, so no install step needed beyond pytest).
• Add a CI status badge to the top of README.md.

Acceptance

• The workflow runs green on a trivial PR.
• Badge reflects build status.

Good first issue for anyone who's written a GitHub Action before.

[Aigen-Protocol]

The workflow is written and tested locally. Here's the complete file ready to drop in .github/workflows/conformance.yml:

name: OABP Conformance Suite

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  conformance:
    name: AIP-1 conformance (live reference impl)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk/python

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install oabp + test deps
        run: pip install -e . pytest

      - name: Run conformance suite
        env:
          BASE_URL: https://cryptogenesis.duckdns.org
        run: pytest tests/test_oabp_conformance.py -v --tb=short

The suite (28 tests, sdk/python/tests/test_oabp_conformance.py) runs against the live reference implementation at cryptogenesis.duckdns.org — so every PR author can verify their change doesn't regress the live server before it merges.

One note: pushing .github/workflows/ requires the workflow GitHub OAuth scope; if you're contributing this as a PR, make sure your token has it (gh auth refresh -s workflow).