fix: make the Trust Manifest MUST rules satisfiable by the spec's own examples

[liady]

Fixes #70.

Two normative MUSTs could not be satisfied by the Claude Plugins appendix examples:

1. The identity binding rule assumed every identifier has a publisher domain segment, but identifier is an open format and the appendix uses urn:claude-plugin:... identifiers with no domain at all. A consumer following the rule as written would have to reject the Trust Manifests in the spec's own examples. The rule is now scoped to identifiers that carry a publisher domain segment (such as the urn:air form), with a fallback to other verification (attestations, signatures) for formats that don't.

2. Digest Format requires consumers to reject digests weaker than SHA-256, yet the appendix mapped the marketplace's git commit sha to sourceDigest as sha1:.... A commit SHA is a revision identifier, not a content digest of anything a consumer can fetch and hash, so the mapping now lands it in entry metadata.sourceSha instead, and the examples no longer carry sourceDigest values that consumers are required to reject.

A dedicated sourceRevision field on the Provenance Link (as floated in the issue) would be a schema addition and would need its own ADR, so it is intentionally out of scope here.