ci(conformance): add Maven conformance runner job (S10 Step 11)

What

Implements Step 11 of the Maven hosted plan (docs/plans/2026-05-12-maven-hosted.md): Maven protocol conformance that runs the external registry-conformance suite with a real mvn client against a freshly started Artifact Registry.

The suite runs entirely inside one job container — the pinned registry-conformance runner image (bundled mvn/JDK plus the conformance CLI):

• build:conformance-ar builds the static AR binary and the Maven provisioning fixture. AR is linked with LabKit config-path overrides (-ldflags -X ...infrastructure.defaultConfigPath=/tmp/conformance-ar/infrastructure.yaml -X ...defaultSecretsDir=/tmp/conformance-ar/secrets) so it renders its infrastructure configuration under /tmp as the runner image's unprivileged user — no root, and no separate service container.
• conformance:maven:s3-garage runs the runner image and boots AR plus a build-time-verified Garage binary as background processes in-job (Garage via the shared .garage-backend template), driving AR over 127.0.0.1:5050.

The harness (maven_setup.sh) writes AR's config, boots AR, provisions a Maven repository fixture, runs registry-conformance run --format maven, publishes its JUnit report, and fails if the runner exits without a report or the report records failures.

Other changes:

• .gitlab-ci-other-versions.yml: adds the Renovate-managed GL_REGISTRY_CONFORMANCE_VERSION pin.
• scripts/conformance/maven_setup.sh: boots AR in-job (write_config → boot_ar → seed_repository → run_suite) at 127.0.0.1:5050, provisions the repository, runs the suite, and validates the report.
• scripts/conformance/maven-provision/: adds the idempotent Maven repository fixture, with a golden test pinning the deterministic namespace UUID.
• .mise.toml: adds the conformance:maven local task.
• docs/dev/conformance.md: documents the suites, the in-job CI topology, the local workflow, and the version pin.

Live-GCS Maven conformance is deferred until its credential path can be provisioned and validated. This delivers S10 AC 28/29 for the mvn client. gradle and sbt remain deferred until the runner ships those drivers.

Validation

• Maven conformance executes the real CLI and produces a JUnit report
• Full run: 29/31 passed, 0 failed; two duplicate-release cases are configuration-gated skips
• AR boots in-job as the runner image's unprivileged user and is reachable at 127.0.0.1:5050
• Garage binary checksum verified before launch (in-job)
• GitLab CI configuration lint
• go build and go vet for the provisioning fixture
• shellcheck, shfmt, yamllint, markdownlint, Vale, and pre-commit hooks on changed files
• Fault-injection check: changing a not-found response from 404 to 418 produced 11 expected failures
• Replacement MR pipeline