security: require explicit trust roots across delegation verification

[imran-siddique]

Summary

Fixes the trust-root verification gap disclosed in GHSA-95qh-qjph-8622.

• require callers to supply an explicit trusted root in offline API and CLI verification
• make the core chain verifier fail closed when no trust root is configured
• preserve structural and cryptographic diagnostics before enforcing root trust
• explicitly scope Agent Manifest integration to signature-and-identity verification
• require agent-manifest >=0.11.1 and release as ca2a-runtime 0.2.1

Evidence

• 510 passed, 2 skipped
• 89.74% coverage
• Ruff lint and format clean
• strict mypy clean
• Bandit clean
• wheel and sdist built successfully
• Twine package validation passed

Security

This PR is intentionally public only after publication of GHSA-95qh-qjph-8622. The advisory contains impact and affected-version details.

[zohebk8s]

Approving. Requiring an explicit trust set and failing closed on an empty one is the right shape, and the core property holds.

One thing worth changing: the root check now runs after the full signature and structural loop rather than before it. I ran the same three chains through verify_chain on current main and on this branch, each time with a trust set that does not contain the chain root:

                             main                      this branch
well formed chain            UntrustedDelegationRoot   UntrustedDelegationRoot
scope escalation at hop 1    UntrustedDelegationRoot   InvalidCredential
forged signature at hop 1    UntrustedDelegationRoot   InvalidCredential

An untrusted caller can now tell "my forged chain is malformed" apart from "my chain is fine but you do not trust my root", which makes the verifier a debugging oracle for chains it will never accept. Counting verify_signature calls before rejection, for an untrusted root:

hops   main   this branch
1      0      1
4      0      4
8      0      8

Callers who benefit from the precise diagnostics already hold a trusted root, so moving the check back to the top costs them nothing. The only behaviour it changes is for an untrusted root.

Three smaller notes. verify-dag declares --trusted-root-issuer with default=[] while its help says it is required with --chain, and nothing enforces it: verify-chain without the flag is rejected by argparse, but verify-dag --dag ... --chain ... parses and then returns UNTRUSTED_DELEGATION_ROOT, reporting a trust decision for what is a missing argument. And the conformance profile passes trusted_root_issuers={chain[0].issuer}, so it never asserts that an untrusted root is refused, which seems worth pinning there given why this PR exists.

And AgentManifestBinding.verification_scope is only ever set to its default and only read by an assertion in test_agent_manifest_cose.py, so it records the signature-and-identity limit without enforcing it. Is something downstream meant to branch on it?

Suite is green on my checkout, 526 passed and 2 skipped.

Needs a rebase, GitHub reports merge conflicts against main. Also worth noting this cannot install until agent-manifest 0.11.1 is on PyPI, so the release is gated on agentrust-io/agent-manifest#331.