docs: refresh commercial protocol documentation for pinned v1.0.0

[GsCommand]

Motivation

• Bring repository documentation into alignment with the pinned, normative v1.0.0 schema set and CID.
• Make verification and contributor workflows explicit so implementers and CI can reliably validate artifacts.
• Improve clarity and consistency across governance, security, and onboarding guidance for downstream runtimes and contributors.

Description

• Updated README.md for formatting, clearer integrity guidance, and consistent runtime import references to @commandlayer/commercial.
• Expanded SPEC.md with a scoped definition, canonical artifact list, and immutable versioning rules.
• Strengthened SECURITY.md with explicit baseline requirements and added integrity check commands (npm run validate and sha256sum -c checksums.txt).
• Replaced placeholder provenance in SECURITY_PROVENANCE.md with the pinned v1.0.0 CID and mirror URIs and documented verification requirements.
• Added CI and local validation guidance to COMPLIANCE.md and clarified contributor setup/validation/checksum steps in ONBOARDING.md.
• Normalized command/code blocks and fixed minor typographic/formatting issues across the edited docs.

Testing

• Ran npm install which completed successfully.
• Ran npm run validate (invokes validate:schemas and validate:examples) and all schema and example validations passed.
• Ran sha256sum -c checksums.txt and all checksum entries reported OK.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.