refactor(qa): migrate dogfood + downstream-contract into packages/qa/ (unified verification-gate home)

Completes the packages/qa/ consolidation started with http-conformance:
all three non-published verification gates (dogfood regression gate,
downstream-contract compatibility gate, http-conformance port gate) now
live under one directory.

Mechanical path migration — no behavior change:
- git mv packages/{dogfood,downstream-contract} → packages/qa/
- rewrite every 'packages/dogfood' / 'packages/downstream-contract'
  breadcrumb: spec liveness proof registry + JSON ledgers,
  spec-liveness-check.yml path trigger, eslint ignore, docs/ADRs,
  source comments
- bump the repo-root traversal one level in the four dogfood conformance
  tests that resolve REPO_ROOT from __dirname

Verified from the new locations: dogfood 273 passed / 3 skipped,
downstream-contract typecheck + 14 tests, spec check:liveness resolves
all bound proofs, http-conformance 41/41.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A1BtxNeUaGmvUYr8FwtUNu

Author: claude

.github/workflows/spec-liveness-check.yml

@@ -9,15 +9,15 @@ name: Spec Liveness Check
 #
 # ADR-0054 (prove-it-runs): bound high-risk 'live' properties must carry a `proof`
 # pointing to a dogfood test that declares the matching `@proof:` tag. The gate also
-# triggers on packages/dogfood/** so deleting/renaming a proof re-runs this check and
+# triggers on packages/qa/dogfood/** so deleting/renaming a proof re-runs this check and
 # the dangling reference is caught (the proof files live outside packages/spec/).
 
 on:
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - 'packages/spec/**'
-      - 'packages/dogfood/**'
+      - 'packages/qa/dogfood/**'
 
 permissions:
   contents: read

content/docs/permissions/authorization.mdx

@@ -87,7 +87,7 @@ export default [
   // backward-compat fixture (#2089) and are intentional.
   {
     files: ['examples/**/*.{ts,tsx,mts,cts}', 'packages/apps/**/*.{ts,tsx,mts,cts}'],
-    ignores: ['**/node_modules/**', '**/dist/**', 'packages/downstream-contract/**'],
+    ignores: ['**/node_modules/**', '**/dist/**', 'packages/qa/downstream-contract/**'],
     languageOptions: {
       parser: tsParser,
       parserOptions: { ecmaVersion: 'latest', sourceType: 'module' },