feat(consumer): versioned IR manifest + drift-check (WHYNOT-WP-0003 T03-T07,T09)

Make ir/ the unit of versioned downstream consumption so consuming repos can
pin a version, inspect it, and follow changes at their own pace.

- T03 ir/manifest.json: per-version inventory + diff anchor with deterministic
  sha256-over-canonicalised-JSON hashes; no-churn generatedAt; manifest schema.
- T07 ir/INDEX.md: human-readable catalog generated by make ir.
- T04 .whynot-design.lock sync-point format + lock schema.
- T05 npx @whynot/design drift: consumer drift-check (bin entry), exit 0/2/3,
  --json/--update/--manifest/--version/--lock.
- T06 CONSUMING.md guide + examples/consumer-fixture/ runnable demo; README +
  MultiFrameworkSupport cross-links; fix README version pin (@0.3.0 not @v0.3.0).
- T09 CONSUMER_CONTRACT_PARITY.md design-only note (live-UI parity deferred).

T02 (publish) and T08 (showcase, blocked on WP-0002 T11) remain wait. Repo stays
in dev mode; no outward publish performed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -48,7 +48,7 @@ Install from the coulomb Gitea npm registry (add the scope to your `.npmrc` firs
 ```
 
 ```sh
-npm i @whynot/design@v0.3.0 lit
+npm i @whynot/design@0.3.0 lit
 # or pin straight from git: pnpm add git+ssh://git@gitea.coulomb.social/coulomb/whynot-design.git#v0.3.0
 ```
 
@@ -64,6 +64,27 @@ import "@whynot/design";
 <wn-pipeline active-idx="3"></wn-pipeline>
 ```
 
+### Tracking whynot-design from a consuming repo
+
+The sections above cover *using* components. Consuming repos also need to follow
+whynot-design's evolution **at their own pace** — pin a version, see what it
+contains, and get a grip on what changed before adopting a newer one. You track
+the technology-neutral **IR** (`ir/`), never the Lit internals:
+
+```sh
+npm i @whynot/design@0.3.0 lit        # 1. pin (your lockfile is the real pin)
+# inspect: node_modules/@whynot/design/ir/INDEX.md  +  ir/manifest.json
+npx @whynot/design drift --update     # 2. adopt a sync-point → .whynot-design.lock (commit it)
+# ...later, after bumping the package...
+npx @whynot/design drift              # 3. report added/changed/removed components + token changes
+                                      #    exit 0 in sync · 3 drift · 2 usage error
+```
+
+When you're ready, review the changed contracts in `ir/INDEX.md`, update your UI,
+and `npx @whynot/design drift --update` to adopt the new sync-point. Full guide:
+**[`CONSUMING.md`](./CONSUMING.md)** · runnable demo:
+[`examples/consumer-fixture/`](./examples/consumer-fixture/).
+
 ### Django
 
 ```django