fix(cmcp-verify): cross-check enforcement_mode in TRACE claim re-verification

[rajnisht7]

What

Extends the enforcement_mode cross-check from #584 (startup-time binding) to claim-time re-verification: verify_trace_claim's optional Agent Manifest binding check now also cross-checks the enforcement mode recorded at claim-creation time against a fresh re-verification of the manifest.

Why

Found while verifying #584 would go fully green: verify_trace_claim (src/cmcp_verify/verify.py) calls verify_agent_manifest_binding too, but never passed enforcement_mode. It's wrapped in try/except so it doesn't crash, and no current test exercises a manifest that declares enforcement_modethrough this specific path, so #584 stays green either way but once agent-manifest ships the enforcement_mode check, any manifest built to spec (enforcement_mode is REQUIRED per 6.2) would start silently reportingagent_manifest.binding: unverifiedhere, with nothing actually wrong. This closes that gap before it can surface:AgentIdentityInfo/AgentIdentityOutnow carry the enforcement mode recorded at claim-creation time, andverify_trace_claimcross-checks it the same way it already does forintent_hash, policy_bundle_hash`, etc.

Security impact

Yes. Same class of change as #584/#576, applied to the claim re-verification path instead of the startup path. Before this change, a claim's recorded enforcement mode was never checked against anything an attacker who could modify a claim or a bug that mis-recorded it) could assert any enforcement mode with no cross-check catching it. After this change, the claimed mode must match what a fresh, cryptographic re-verification of the manifest actually attests, or the binding is reported unverified. Also hardens against a garbled/invalid claimed value (ValueError from an unrecognized enforcement_mode string) now fails closed via the same except path as every other binding failure, instead of raising unhandled.

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!