CI: run the C# content-vector suite; document cultnet-ts/content

cultmesh-portability.yml gains 'Verify the content vectors with the C# reference' (CultMeshContentVectorTests), the first
CI run of the C#/Rust content parity and of the TypeScript manifest vectors. The README describes what cultnet-ts/content
owns and how the ts-written file is regenerated.

Builds. Co-Authored-By below.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/cultmesh-portability.yml

@@ -101,7 +101,8 @@ jobs:
       # pull requests: cultnet-interop.yml is windows-latest and main-only, so
       # until these steps existed the shared verifier's tests never ran on
       # Linux at all, and the browser client's never ran in CI on any OS.
-      # packages/cultnet-ts verifies both vector files; cultmesh-browser proves
+      # packages/cultnet-ts verifies both vector files (content.test.ts judges both
+      # C# content files, the Rust one and its own); cultmesh-browser proves
       # the browser client reads the shared rules rather than its own.
       # No workflow ran cultcache-ts's tests, and its test script listed two files by hand while a third sat compiled
       # and unrun. The wiring check fails when any TypeScript test file is run by no script, and the cache's own suite
@@ -147,3 +148,14 @@ jobs:
           dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
           --filter FullyQualifiedName~RealtimeWireProtocol
           --logger "console;verbosity=minimal"
+
+      # The content plane: the reference writes the manifest and record-key
+      # vectors and judges the manifests the TypeScript packer wrote
+      # (content-vectors.ts-written.json). This suite also holds the C#/Rust
+      # content parity, which no CI step ran before this one. CULTNET_WRITE_VECTORS
+      # is never set in CI: the committed files are the contract.
+      - name: Verify the content vectors with the C# reference
+        run: >-
+          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
+          --filter FullyQualifiedName~CultMeshContentVectorTests
+          --logger "console;verbosity=minimal"

packages/cultnet-ts/README.md

@@ -126,6 +126,27 @@ Current wire-contract options:
 So the transport can stay developer-friendly while the binary stops freelancing
 away from the C# lineage.
 
+## Content
+
+`cultnet-ts/content` owns the TypeScript shapes of the CultMesh CDN
+(`src/content.ts`, the twin of `CultMeshCdn.cs`): the artifact manifest and chunk
+reference, their MessagePack form, hash normalization, both record-key grammars,
+SHA-256 hashing through WebCrypto, and `packContent`. It is browser-safe: it
+imports no `node:` module, so a browser bundle can take it.
+
+- A manifest names its chunks by hash and carries no endpoint. Where the bytes
+  are fetched from is the caller's to resolve through CultMesh.
+- Metadata is an ordered list of `[key, value]` entries, never an object: a JS
+  object reorders integer-like keys, and the entry order is the wire bytes.
+  Duplicate keys, integers a JS number cannot hold exactly, and payloads nested
+  past the shared depth limit are refused.
+- Bytes and keys are held to files the C# reference writes
+  (`contracts/cultmesh/content-vectors.cs-written.json`,
+  `cdn-record-key-vectors.json`) and to `content-vectors.rs-written.json`.
+  The TypeScript-written `content-vectors.ts-written.json` is judged by the C#
+  reference. Regenerate it with `npm run build --workspace packages/cultnet-ts`
+  and `node scripts/write-cultmesh-content-vectors.mjs`; never edit it by hand.
+
 ## Local Fast Lane
 
 For direct-pipe neighbors that already share the same CultCache formatter