feat(runtime): wire agent-manifest delegation verifier as inbound peer check

[imran-siddique]

Expose the agent-manifest delegation verifier as a check ca2a can call on an inbound peer request, so the two implementations stay aligned rather than duplicated.

[carloshvp]

This feels like the right place to keep the verifier boundary narrow: cA2A should call the agent-manifest delegation verifier as an authority on delegation validity, then apply cA2A-local transport/session/policy decisions around that result.

A contract that would make the integration easier to test and keep aligned:

• inputs: inbound peer identity, presented delegation credential or reference, expected delegator/delegatee binding, requested operation/scope, session/channel binding material, and trusted issuer/key material
• positive result: normalized verified delegation facts, including issuer, delegator, delegatee, effective scope, expiry/not-before, credential id, and any TRACE/delegation-link reference needed by feat(trace): TRACE A2A delegation-link profile field + validation #15
• provenance failures: malformed credential, unknown issuer/key, invalid signature, expired/not-yet-valid credential, broken delegator/delegatee binding, broken session/channel binding
• authorization failures: valid credential but requested operation outside effective delegated scope
• local policy failures: valid delegated scope, but denied by the local cA2A policy intersection layer from feat(policy): intersect delegated scope with local Cedar policy #10

I would keep those result classes explicit so callers can distinguish “bad delegation evidence” from “valid delegation, but not authorized here.” That distinction is important for auditability and lines up with the action evidence pattern in agentrust-io/trace-spec#66 / agentrust-io/cmcp#339: valid negative outcomes are still useful provenance.

For tests, I think this issue and #15 can share conformance fixtures: valid delegation, invalid signature, unknown issuer, expired credential, delegatee mismatch, scope widening attempt, session/channel binding mismatch, and valid credential denied by local policy. Happy to help shape those fixtures if useful.