[cbrady]

Adds signContext, which a customer's backend calls to sign the company and user a browser SDK sends with a publishable key, for environments that require context signatures. It returns the X-Schematic-Context-Sig value the JS SDK's getContextSignature expects. A signature lasts 10 minutes by default; lifetimeSeconds accepts up to the API's one-hour maximum, and issuedAt sets the start time. It matches the Go helper (SchematicHQ/schematic-go#263).

JSON.stringify doesn't produce the API's canonical form, so the helper builds the JSON itself. It sorts keys by code point rather than by UTF-16 code unit, escapes U+2028 and U+2029, and signs a lone surrogate as U+FFFD, which is how the API reads one. It throws when a key's value isn't a string, rather than signing something the API would canonicalize differently.

The tests run the shared vectors from the API (SchematicHQ/schematic-api#9729), copied into tests/unit/. They stay out of conformance/vectors/ because the lease runner loads every file there. Merge after #9729, and refresh the copy if the vectors change there.