Add ZAP wire v1 session semantics

[modelsbridgeaicom-ship-it]

Summary

Refs #85.

This adds a concrete ZAP Wire v1.0 session layer around the existing ZAP PaymentOffer / PaymentProof payload codecs:

• publishes docs/zap-wire-spec-v1.0.md covering handshake, capability negotiation, sequence numbers, ACK, retry, request-id idempotency, and FIN behavior
• adds pure-Python ZapWireFrame, ZapWireSession, ZapRetryPolicy, and related enums/errors in switchboard/zap_transport.py
• keeps the existing offer/proof ZAP payload codec unchanged
• adds static byte-for-byte conformance vectors in tests/conformance/zap_wire_v1_vectors.json
• adds Python tests for frame parsing, handshake, duplicate handling, retry, FIN, and vectors
• adds a standalone Go vector consumer under tests/conformance/ for cross-implementation header/vector checks

Validation

• python -m pytest tests\test_zap_wire_session.py tests\test_zap_transport.py -q -> 10 passed / 30 skipped (zap_py unavailable locally)
• python -m py_compile switchboard\zap_transport.py tests\test_zap_wire_session.py
• git diff --cached --check

I also tried the full python -m pytest -q suite. It is not counted as passing locally because this Windows host is missing optional cryptography and flask, and tests/test_web_lab.py reads UTF-8 web assets with the Windows GBK default encoding. The new focused ZAP tests pass cleanly.

The Go vector consumer is included but was not run locally because this host does not have go installed. It uses only the Go standard library and can be run with cd tests/conformance && go test ..

[abhicris]

🤖 Audit verdict: safe

Protocol implementation with comprehensive error handling, proper validation, no malicious payloads, no external dependencies, no credentials, test vectors verify against spec.

Audited by the kcolbchain PR pipeline. See pipeline docs.

[Pattermesh]

Your PR was selected as the winning submission for this issue — great work! However, it now has merge conflicts with main (from other recently merged PRs). Could you please rebase against main and force-push? We'll merge as soon as the conflicts are resolved. Thank you!