feat: enforce the published JSON Schemas in the runner and CI

[requie]

Summary

The four schemas under schemas/ were published but never applied. The runner used a hand-rolled required-field check that required three fewer fields than the test-case schema (pattern_version, target_profile, expected_secure_behavior), adapter payloads were never validated, and the registry was never checked against the taxonomy schema. A malformed adapter payload could also raise an uncaught KeyError from Event.from_dict.

The schemas are now enforced. Full validation uses the optional jsonschema package through a new schema extra that CI installs. Without it, a structural fallback reads its required fields and safety keys from the schema itself, so the two can no longer diverge.

Pattern or implementation impact

Technical review. No taxonomy, case, or schema content changes; all 200 cases and the registry already validated under the published schemas, so this adds enforcement only.

• src/caap_benchmark/schemas.py: new. Loads the bundled schemas, reports whether jsonschema is available, and returns schema violations with JSON paths.
• src/caap_benchmark/loaders.py: validate_test_case uses the test-case schema; structural_test_case_errors is the dependency-free fallback driven by the schema's required list, pattern_id pattern, and safety keys.
• src/caap_benchmark/adapters/http.py: _normalize (shared with the command adapter) validates every payload against the adapter-response schema and returns test_error for a malformed one instead of raising.
• src/caap_benchmark/cli.py: caap validate reports which validator ran.
• scripts/generate_catalog.py: copies the schemas into the package data. scripts/validate_repository.py: checks those copies match, and validates the registry and all 200 cases against the schemas when jsonschema is available (prints a note otherwise).
• pyproject.toml: schema extra; dev extra now includes PyYAML and jsonschema; schemas added to package data.
• .github/workflows/ci.yml: installs [yaml,schema]. .github/workflows/release.yml: previously installed only build and then ran the unit tests without the package importable, so it would have failed on the first tag; it now installs [dev] and runs ruff before the checks.
• tests/test_schemas.py: new, 13 tests. Docs: docs/CONFORMANCE.md (schema enforcement section), README.md (extras), CHANGELOG.md.

Safety impact

Not applicable. No fixture, capability, sink, network boundary, persistence boundary, or public procedure changes. The change makes the runner stricter about what it accepts: a malformed adapter payload yields test_error, never pass.

• Authorized targets only
• Synthetic data and identities only
• Mock tools, sinks, and actuators only
• No destructive payload, real exfiltration, persistence, or approval bypass

Validation

• Generated files are current (regenerated twice; no drift; four schema files bundled)
• Repository validation passes with full schema validation of the registry and 200 cases, and passes with the structural fallback when jsonschema is blocked
• Unit tests pass: 41 with jsonschema installed, 37 plus 4 skipped with its import blocked
• Secure mock passes (unchanged; the mock's response also validates against the adapter-response schema)
• Vulnerable synthetic behavior fails when an executable case changes (no executable case changed)
• caap validate on a case missing target_profile with an invalid severity rating reports both violations with their JSON paths
• ruff check src tests scripts examples is clean
• Commit includes DCO sign-off