Update to ACP 2026-04-17 and cut a first stable release #10

The module targets ACP 2025-09-29 and pins an API version that was never released.

Current state

• ComplianceService::API_VERSION = '2025-10-01' — not a published ACP version; it traces to a hypothetical in upstream's CONTRIBUTING.md. Compared with strict === as the first gate on every endpoint, so every conformant client is rejected.
• Payload shapes match 2025-09-29; latest open-spec release is 2026-04-17.
• No stable tag.

Asks

1. Fix the version gate — accept a set of released versions, return 400 with supported_versions[].
2. Migrate payloads to 2026-04-17. The bulk of the cost is the 2026-01-30 release, not the newest one; 2026-01-16 can be skipped entirely, as its headline feature was reverted 14 days later.
3. Pin upstream by commit SHA — spec/2026-04-17/ was modified twice after release, and a copy taken before 6b82868 has a wrong Order model.
4. Tag a first stable release once payloads conform.