feat(core): data model + trace parser + event normalizer

[sepehr-safari]

Summary

Implements the core data model with Zod schemas, the parseTrace() function accepting JSON Object / JSONL / bare array formats, and normalizeEvents() that classifies message types, directions, and timestamps.

Closes #20

Changes

New files

• packages/core/src/schemas.ts — Zod schemas for Trace, TraceEventInput, TraceMetadata, RawOcppMessage (prototype pollution protection)
• packages/core/src/normalizer.ts — normalizeEvents(), direction inference (ADR-0004), timestamp normalization (ADR-0005)
• packages/core/src/parser.ts — parseTrace() accepting JSON Object, JSONL, and bare array
• packages/core/src/normalizer.test.ts — 46 tests
• packages/core/src/parser.test.ts — 32 tests

Updated files

• packages/core/src/types.ts — added Failure, FailureCode, FailureSeverity, Scenario, SessionSummary, ValidationResult types
• packages/core/src/index.ts — updated barrel exports
• packages/core/package.json — added zod dependency
• CURRENT_STATE.md — updated to reflect v0.1.0 milestone progress

Security Checklist

• No hardcoded secrets, tokens, API keys, or credentials
• No personal or sensitive information in committed artifacts
• No eval(), Function(), or dynamic code execution on untrusted input
• Safe JSON parsing — try/catch + size guard (10 MB)
• No prototype pollution — Zod validation on all input
• Path safety in CLI — N/A (no CLI in this PR)
• No ReDoS-vulnerable regex patterns
• File-size and event-count limits enforced (10 MB, 10,000 events)
• Safe rendering — N/A (no UI in this PR)
• No console.log of sensitive data in production paths
• Input validation on all external entry points
• Non-sensitive error messages
• .env files gitignored

Verification

• pnpm lint — ✅
• pnpm typecheck — ✅
• pnpm test — ✅ (107 tests, all passing)
• pnpm build — ✅
• pnpm format:check — ✅