Accept TypeScript, Python, and Kotlin classification-core ports with mirrored corpus and drift tests

basecamp-sdk needs connect-time address classification in TypeScript, Python, and Kotlin to extend its OAuth SSRF policy (SPEC §16 requirements 5–6) beyond Go and Ruby. No classification tables exist in any of those three ecosystems today, and the corpus README already frames the design as "one policy, N implementations" — so the ports belong here, not vendored into the SDK.

What a port consists of (sized from the existing implementations — ~400 lines of Ruby, ~1,040 hand-written lines of Go for the classification/resolution core):

- **Classification + resolution core** implementing the two fixed policies (`default`, `iana_special_use`) with the same public surface shape as the Ruby gem (5 public methods; Ruby is the stated policy source of truth).
- **IANA table generator** consuming the shared snapshots in `script/iana/*.json`, writing marked regions, matching the Ruby/Go generators.
- **Mirrored conformance corpus**: the 157-case corpus under `conformance/` consumed verbatim, plus a byte-equality drift test between the mirror and the canonical copy (the pattern `go/testdata/` already establishes).
- **Change protocol honored**: corpus + every implementation updated in one commit.

Deliberately out of scope for the ports (matching the gem's design): enforcement layers. Dial/redirect/client enforcement is consumer territory — Go's enforcement layers live here because Go's `Control` hook makes them generic, but each SDK will wire its own seam (undici `Agent` lookup for Node, custom httpx transport for Python, OkHttp `Dns` for JVM). The ports only need classification + resolve.

Also matching the gem's design: **no loopback policy mode**. Consumers that need loopback admit it as explicit operator-controlled configuration on their side; the tables stay fixed.

Sequencing: independent of the 0.2.0 gem release issue, but the corpus schema is shared — a port should mirror whatever corpus version is current when it lands.

Start with the Ruby implementation as the policy source of truth and compare the existing Go classification/resolution core and generators. Read the shared snapshots in script/iana/*.json and the 157-case corpus under conformance/, including the go/testdata/ mirroring pattern. Done means the three ports implement both policies, mirror the corpus with a byte-equality drift test, and follow the corpus-plus-implementation change protocol.

Written by the indexing model from the issue text.