ci: repin conformance harness to published 0.2.0-alpha.10
Repins the conformance harness to the published 0.2.0-alpha.10 release, which contains the sep-2575 checks asserting the final spec #3002 discover shape (conformance #403) and per-check expected-failures granularity (#406) that the previous temporary pkg.pr.new pin (main@da56f663) existed to pick up early — plus #409, a client request-metadata scenario fix.
The pin stays in the tarball-URL + CONFORMANCE_PKG_SHA256 form (registry version specs and dist-tags are movable; the digest is not), now pointing at the npm registry tarball for the published release. The fetch-and-verify step is unchanged.
Expected-failures comments now name the alpha.10 pin instead of the commit SHA; no baseline entry changes.
All six CI legs (server active/draft/2026/all, client all/2026) pass locally against alpha.10, including the server active leg run against the digest-verified local tarball via the same file: repoint the workflow step performs.