feat: independent Agent Commerce receipt verification (#2)

[dkitchell]

Summary

Implements #2 — certifieddata-verify <receipt-id> verifies Agent Commerce payment receipts locally: fetch the payload + signature envelope, fetch the Agent Commerce PEM from .well-known, RFC 8785 JCS-canonicalize (the repo's existing zero-dep canonicalizer), verify Ed25519 with Node crypto, recompute SHA-256 against the stored hash. Zero new dependencies.

The server's booleans never determine the verdict — proven by a lying-server test where {valid: true, signatureValid: true} accompanies a tampered payload and the CLI still says INVALID.

Artifact-kind resolution (per spec)

src/resolve.ts: prefix hints → endpoint-URL hints → local JSON schema sniff → dual-endpoint probe for bare UUIDs. Exactly-one wins; both → AMBIGUOUS (exit 64, requires --type); neither → NOT_FOUND; transport failure → NETWORK, never "not found". --type certificate|receipt overrides everything.

Fail-closed key handling

PEM endpoint 503/unreachable → UNKNOWN_KEY exit with an explicit "the server's own verdict is NOT accepted as a substitute" message. --offline receipts require --key <pem>.

Acceptance criteria

• certificate behavior backward compatible — all 34 pre-existing tests pass untouched
• --type receipt / --type certificate override detection
• receipt signature verified with Node crypto, not the server verdict
• canonicalization = RFC 8785 JCS (same canonicalizeToBytes used for certs)
• payload SHA-256 recomputed locally vs stored hash
• key from /.well-known/certifieddata-public-key.pem
• 503/missing key → non-success exit, no silent fallback
• tampering with any signed field fails — 9-field tamper matrix (amount, policy_hash, artifact_hash, agent_id, purpose, status, settlement_state, timestamp, receipt_id)
• live end-to-end against a production receipt — blocked on platform deploys landing: platform#318 (exposes signature + canonicalization + public_key_url on the verify endpoint) and platform#319 (fixes the PEM endpoint's ESM dynamic-require 503). Both merged; will confirm and post the terminal transcript here once production serves them.

Tests: 49/49 (15 new). Lint + typecheck clean.

🤖 Generated with Claude Code

[dkitchell]

Live end-to-end against production is now confirmed — both platform deploys (#318 signature exposure, #319 PEM ESM fix) landed. Fresh receipt from a fully anonymous stranger run tonight:

$ certifieddata-verify 2a37d835-e50d-4a59-99ad-5fe1d346871f
✓ VALID  receipt 2a37d835-e50d-4a59-99ad-5fe1d346871f
  signed by    (published Agent Commerce key) (CertifiedData.io)
  signature    pass
  payload hash pass
  public key   /.well-known/certifieddata-public-key.pem
  settlement   simulated_sandbox
  The verdict above was computed locally — not taken from the server.

Auto-detection also confirmed live: the bare UUID resolved via the dual-endpoint probe (receipt exists, certificate doesn't → receipt path) with no --type needed.

The receipt itself carries the full evidence chain from #315: non-null policy_hash matching the policy snapshot at authorization time, truthful settlement_state: simulated_sandbox, settled_at bound. All acceptance criteria now pass.