feat: add verifiable execution passports

[aantenore]

Outcome

Adds Execution Passport v1: a strict in-toto Statement that binds a RunBundle, its complete ConformanceReport, and an opaque externally validated OASF record without embedding those artifacts.

Trust and interoperability

• exactly three ordered, content-free subjects
• project-owned versioned predicate URI
• explicit run and conformance states
• fail-closed report, receipt, identity, rule, and time consistency
• optional placement evidence as metadata-only digest descriptors
• external DSSE/Sigstore boundary with explicit unsigned vs authenticated consumer policy
• mapping-only OASF and StageFabric adapters with documented information loss

Verification

• npm run release:check
• 81 tests
• lint, typecheck, coverage, build, publint, API type and package smoke checks
• production dependency audit: 0 vulnerabilities
• repository identity and forbidden-string audit passed

No provider SDK or signing implementation is coupled to the core.