Align TRACE ownership and prepare separate conformance publishing

[imran-siddique]

Align with the canonical maintainer coverage rollout. The gate reads validated policy only from the reviewed base commit, with a one-commit bootstrap for initial deployment. It preserves current-head human review and independent branch protection.

Louie and Rajnish have verified write access and regain explicit ownership of the imported conformance suite and its workflows. Active contribution/navigation links point to conformance. A separate conformance publisher reuses installed-artifact build checks, ignores root library tags and validates conformance release tags against the package version. Manual execution defaults to build-only. TestPyPI and PyPI publication each require an explicit enable variable and separate environment/trusted-publisher configuration. The old publisher and documentation deployment remain active until verified replacements exist.

Validation: nine Node approval-boundary tests passed; generated policy, owners and gate matched the canonical record. Reducing security approvals to one made three tests fail. Publisher configuration and real publication have not been performed. Repository CI and independent maintainer review remain required.

[lywinged]

Checked the gate against the previous one, the policy and CODEOWNERS against the roster in agentrust-io/.github#52, and that root v* tags cannot trigger the conformance publisher. Approving.

[lywinged]

@imran-siddique a note on the gate from #462, seen on #454.

The script reads .github/maintainers.json at pr.base.sha. A pull request opened before #462 merged keeps the base it was opened on, which has no policy file and is not c5cfa00, so its next push makes the gate throw HttpError: Not Found. On #454 the push of 5e8e635 failed this way with base.sha still at 4d60e4a. Merging main into the branch moved base.sha to 99b7693 and the gate passed. It fails closed, so nothing gets through, but the log does not tell the author what to do.

The open pull requests whose base has no policy file are #363, #376, #404, #438, #456, #457, #458, #459 and #460. Each one clears once its branch is updated from main. If you would rather handle it in the gate, it could read the policy at the tip of the base branch, or use the bootstrap list for any base that has no policy file and is an ancestor of c5cfa00. Either keeps the policy coming from reviewed base-branch data.