test: add action receipt conformance fixtures

[carloshvp]

What this changes

Refs #95. Builds on #66 and agentrust-io/cmcp#392.

Adds nine signed action-receipt conformance fixtures for:

• valid controller acceptance and valid controller abort;
• a missing required receipt;
• signature/key and action_ref mismatches;
• stale evidence and a receipt-chain gap;
• a valid same-party self-report with an issuer-independence warning; and
• an unsupported physical-completion claim.

The fixture contract uses RFC 8785 JCS for action_ref, detached evidence hashing, and the Ed25519 receipt signature preimage. Each case pins the trusted issuer key outside the receipt and carries machine-readable expected results.

tests/test_action_receipt_fixtures.py recomputes the hashes, verifies signatures, checks call/session binding, enforces freshness and receipt ordering, and compares each result with the fixture expectation.

The fixtures are static. They add no ROS runtime dependency and do not change the TRACE schema, library API, or normative spec text.

Type of change

• Editorial (typo, link fix, clarification, no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

Informative examples for spec/trace-v0.1.md section 3.3.2, "Action receipts for embodied workflows."

Validation

• uv run --extra dev ruff check src/ tests/
• uv run --extra dev pytest -q (89 passed)
• uv run --extra dev mypy src/agentrust_trace
• assembled MkDocs build using the repository's CI layout
• git diff --check

Backward compatibility

No schema, API, or normative verification behavior changes.

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (not applicable; no normative change)
• Breaking changes marked in spec text (not applicable)
• Backward compatibility statement included