[csnitker-godaddy]

Summary

The SDK lacks merged V2 management and Verified Identity features, and several verification paths accept evidence that does not satisfy the merged ANS trust requirements. This change adds the missing client surface and closes those verification gaps against ans-registry f2373f1.

• Add owner-scoped agent listing, CSR/BYOC server-certificate renewal, optional identity CSR, metadata hashes, DEPRECATED status, and shared naming validation.
• Add all eight identity-management operations and all six public TL identity reads. Preserve unavailable identity joins separately from empty lists.
• Prepare control proofs for external/local signers and verify did:web/did:key proofs using sealed JWK/Multikey methods with Ed25519, P-256, or RSA. Bind current badges to their proof events and keep revocation terminal.
• Require authenticated TLSA owner/alias paths, select the caller's exact badge version, protect root-key retrieval with HTTPS/no redirects, validate SCITT artifact pairs and JCS receipts, and keep outgoing header reads free of network I/O.

V1 reading and Method B's explicit receipt waiver remain supported. V3 is excluded; LEI/ENS proof profiles remain postponed by the merged spec. Historical proof verification does not establish current status or audit completeness. See docs/SPEC-COMPLIANCE.md for the contract matrix and trust boundaries.

Compatibility

identity_csr_pem becomes Option<String>; existing registration constructors still preserve supplied values. Fqdn/version parsing rejects invalid forms. Call ScittHeaderSupplier::initialize before serving requests. Migration examples and behavior are documented in MIGRATING.md.

Stack

Depends on #126, based exactly on 3a45dbccbf0f40941b02b7f12cd205ae67b2bd3d. The base branch mirrors that dependency head so this diff contains only the feature/compliance work. Merge #126 first, then retarget this PR to main before merging.

Validation

All 12 GitHub Actions checks pass on 998b044a417425eb66c24b5ba6440c890b4be1f7. DCO remains pending human certification.

• 977 tests pass with each P-256 verification backend; five pre-existing ignored tests remain.
• Format, Clippy, benchmark smoke tests, Rust 1.88 all-target checks, release build, and documentation pass.
• Coverage: 91.78%, retaining the 90% gate.
• Current cargo audit and cargo-deny checks pass without new ignores.
• Independent read-only review identified two issues; regressions cover the repaired DNS alias path and unavailable identity-join signal. DNS evidence is deterministic testing and source tracing, not a live deployment test.

Fixes #82
Fixes #118

AI assistance

Assisted-by: OpenAI Codex (GPT-6)

Draft pending the human submitter's DCO certification. No Signed-off-by trailer has been added for this feature commit.