feat(sdk): P5.1 @insignia/iios-adapter-sdk — ChannelAdapter contract + HMAC webhook adapter + sandbox + fixtures

Contract (capability incl. requiresFollowupFetch seam, verifySignature, normalize,
fetch?, send), HMAC-SHA256 sign/verify (timing-safe), reference WebhookAdapter
(normalize→IngestInteractionRequest), SandboxSink (no network), email/whatsapp
fixtures. CJS build (consumed by the NestJS service). 4 tests; boundary updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-adapter-sdk/src/fixtures.ts

@@ -0,0 +1,27 @@
+import { hmacSign } from './hmac';
+import type { WebhookPayload } from './webhook-adapter';
+
+/** Email-shaped provider payload (as the adapter's normalize input). */
+export const emailFixture: WebhookPayload = {
+  eventId: 'email-1',
+  from: 'someone@example.com',
+  displayName: 'Someone',
+  threadRef: 'mail-thread-1',
+  subject: 'Question about my plot',
+  text: 'Hello, I have a question.',
+};
+
+/** WhatsApp-shaped provider payload. */
+export const whatsappFixture: WebhookPayload = {
+  eventId: 'wa-1',
+  from: '+15551234567',
+  displayName: 'WA User',
+  threadRef: 'wa-group-1',
+  text: 'hi from whatsapp',
+};
+
+/** Produce a signed request (body + headers) for tests/smoke. */
+export function signedFixture(payload: object, secret: string): { body: string; headers: Record<string, string> } {
+  const body = JSON.stringify(payload);
+  return { body, headers: { 'x-iios-signature': hmacSign(body, secret), 'content-type': 'application/json' } };
+}