[jm-rivera]

This adds two client rules on top of #24: every API request names its client in an X-DFO-Client header, and a fetched dataset comes back with its columns and rows in reading order.

The client-identity rule (rules/client-identity.json, 18 vectors) has every API request carry X-DFO-Client: <client>/<version> (<runtime>), such as dfo-python/0.1.0 (CPython 3.14) or dfo-ts/0.1.0 (browser). A caller's headers or header provider naming it raise header_invalid, and no request to another origin, a signed storage URL included, carries it. Scenario records hold no request headers, so a client's replay checks that each path and origin_path request carries the header and each url request does not.

The reading-order rule replaces column-order from #24 (rules/reading-order.json, 10 vectors with rows). Columns run: the filled reading slots, then the other columns whose values differ between rows, then the constant columns, with stat_var last. Rows within each member sort by the filled slots without value and the time period, then by the varying columns, then by the time period, so a CRS series of Germany's health ODA to Nigeria split by co-operation modality reads every A02 year, then every C01 year. Keys sort ascending with nulls last, ties keep served order, and members keep member order. A client hashes the file before ordering anything, so digests and refs keep the server's file.

tools/validate_client_contract.py reads each served Parquet file once through served_table and checks every scenario's columns and every vector's rows. Scenarios pin columns only, because dataset outcomes hold no rows; the vectors pin row order. 28 scenarios change their columns and no body file changes.

The base-URL rule now states every check both clients make: no userinfo (an empty one included), query, fragment, dot segment, character outside visible ASCII, or IPv4 host in a form other than four decimal numbers. A relative URL is valid only in a TypeScript client inside a browser page, and a valid value is used less its trailing slashes. Seven new vectors in rules/base-url.json pin these cases. The User-Agent sentence now names every runtime outside a browser where TypeScript sends it.

The role-keys rule (rules/role-keys.json, 13 vectors) names the keys of entities=: place for the subject, posted as observationAbout, and origin and destination for flows. Spec.roles and specRoles(spec) list a spec's roles under those keys, and a key outside them, such as observationAbout or a column name like financingRecipient, raises invalid_argument naming the spec's roles.

Testing: the validator reports 122 valid scenarios; pytest tools/tests with pyarrow, 543 passed; python/client-contract tests, 144 passed.