Part of #621.

Adds .github/workflows/lws-conformance.yml — the repo's first workflow — which starts JSS in single-user mode and runs Touchstone's composite action against it on every push to gh-pages, every PR, and on demand (workflow_dispatch with a module input: all, core, auth, core/containers, or one test id).

This is a scoreboard, not a gate. fail-on-nonconformance is off because JSS implements none of the LWS core protocol yet; expect the first run to fail most MUSTs. The job only goes red on Touchstone exit 2 — misconfigured workflow or unreachable server — so a broken scoreboard is visible rather than silently empty.

What you get per run:

• the Touchstone markdown report in the job summary
• a touchstone-report artifact with run.json, earl.ttl, junit.xml, report.html, report.pdf
• the JSS log

Not done here, deliberately:

• Auth. The server runs with no capabilities declared, so the three auth suites report inapplicable and writes fail WAC. The TOUCHSTONE_TOKEN_ALICE/BOB env and capabilities: Authentication lines are present but commented out until there is an LWS authorization server that can mint tokens (Track: LWS protocol conformance (Oct 2026 drafts) — core vs plugin split, Touchstone as acceptance test #621 plugin work, plugin api: api.auth.registerVerifier() — plugin-issued credentials accepted on pod resources #622).
• Pinning. Uses ebremer/touchstone@master as its docs recommend. The action builds the Docker image from source each run (JDK 21 Maven build, a few minutes); worth pinning to a tag once Erich cuts one.

Related: #622 #623 #624 #625