test: add opt-in source provenance audit for NT009 (#95)

[vitormattos]

SUPERSEDED — no merge. This Python-only exploratory PR was replaced by the PHP migration #97 and the signed, PHP-only official-source audit #99. The Python implementation is intentionally abandoned.

---

Scope — partial preparatory PR for #95

This PR adds an explicit, opt-in audit of the exact October 2026 NT009 Anexo VI v1.04.01 and Anexo VII v1.03.00 official source URLs, with SHA-256 pinning to independent downloaded observations. It uses the existing stdlib-only XLSX reader and keeps CI deterministic without requiring the official portal to be online.

Not an implementation of NT009: official workbook bytes could not be retrieved in this execution environment, so no unverified tax domain code or XML structure was committed.

Verified baseline

• The current domain table contains 26 Anexo C v1.01 entries, not the NT009 Anexo VII table.
• XmlBuilder currently nests CST/cClassTrib inside gIBSCBS and requires cIndOp even though NT009 changes their location/conditionality.
• The existing production XSD bundle is 1.01 (2026-02-09); replacing the XML shape without a new contract selector would break schema validation.
• Consumer akaunting-nfse pins dev-main#f179d7f723bec80f5b19a25dfbc385a612c2447f and has not been changed.

Completion blockers

• Download, verify, extract and compare both XLSX files against the shipped data and authoritative XSD.
• Preserve earlier XML contract and implement separately selectable future NT009 layout only after validating official conditions, effective date and relevant XSD availability.
• Generate and independently diff the whole Anexo VII TSV, record its exact cardinality and run XML / lint / Psalm / all CI checks.

Do not merge this PR as completion of #95. Closes nothing; issue remains open.