feat(consumer): versioned IR manifest + drift-check (WHYNOT-WP-0003 T03-T07,T09)

Make ir/ the unit of versioned downstream consumption so consuming repos can
pin a version, inspect it, and follow changes at their own pace.

- T03 ir/manifest.json: per-version inventory + diff anchor with deterministic
  sha256-over-canonicalised-JSON hashes; no-churn generatedAt; manifest schema.
- T07 ir/INDEX.md: human-readable catalog generated by make ir.
- T04 .whynot-design.lock sync-point format + lock schema.
- T05 npx @whynot/design drift: consumer drift-check (bin entry), exit 0/2/3,
  --json/--update/--manifest/--version/--lock.
- T06 CONSUMING.md guide + examples/consumer-fixture/ runnable demo; README +
  MultiFrameworkSupport cross-links; fix README version pin (@0.3.0 not @v0.3.0).
- T09 CONSUMER_CONTRACT_PARITY.md design-only note (live-UI parity deferred).

T02 (publish) and T08 (showcase, blocked on WP-0002 T11) remain wait. Repo stays
in dev mode; no outward publish performed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/consumer-fixture/README.md

@@ -0,0 +1,36 @@
+# consumer-fixture — the drift loop, copy-pasteable
+
+A tiny stand-in for a repo that **consumes** `@whynot/design`. It exercises the
+full downstream loop — **pin → inspect → drift → update** — against this repo's
+own `ir/manifest.json`, with no real npm install, so you can see exactly what a
+consumer experiences.
+
+```bash
+./run.sh
+```
+
+What it shows:
+
+1. **Inspect** — the head of `ir/INDEX.md` (the browsable catalog of the version).
+2. **drift** — [`adopted.lock`](./adopted.lock) is a sample `.whynot-design.lock`
+   pinned to a pretend older `0.2.0` sync-point (Button changed since, TopNav added
+   since, tokens changed). `drift` reports those and exits `3`.
+3. **drift --update** — adopts the current version as the new sync-point.
+4. **drift** again — now in sync, exits `0`.
+
+The run is **non-destructive**: `adopted.lock` is copied into a scratch dir and
+only the copy is mutated.
+
+## In a real consuming repo
+
+You would **not** pass `--manifest`/`--lock`. The installed package supplies its
+own `ir/manifest.json`, and the lock lives at `./.whynot-design.lock`:
+
+```bash
+npm i @whynot/design@0.3.0 lit     # pin
+npx @whynot/design drift --update  # adopt a sync-point (writes .whynot-design.lock)
+# ...later, after bumping the version...
+npx @whynot/design drift           # see what changed; exit 3 on drift
+```
+
+Full guide: [`../../CONSUMING.md`](../../CONSUMING.md).