conformance: sync packaged trace-claim.json and digest/level docs (#515)

[drk-ram]

What this changes

Closes #515. Related: #247, #448 (items 2, 5, 23).

1. Synchronize conformance/schemas/trace-claim.json with schema/trace-claim.json (src/agentrust_trace/schema/trace-v0.2.json):
   • Copies the normative 894-line schema/trace-claim.json to conformance/schemas/trace-claim.json so all three schema copies in the repository are byte-identical.
   • Restores missing v0.2 properties (references from §3.1.2, reproducibility from §3.1.4, and appraisal sub-properties method, re_execution from §3.1.4, and platform_measurement from §3.1.5), $defs/canonicalizableValue on cnf.jwk (Implementation findings from the Go verifier (#444): 26 items #448 item 2), the iat upper safe-integer bound (maximum: 9007199254740991), the canonical 86-character base64url signature pattern ([AQgw]), the full subject pattern (^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$), and the RSA key-material allOf requirement (n and e).
2. Update conformance/tests/test_digest_parity.py:
   • Generalizes SCHEMA_SITES, _schema_pattern, and visit from 2-tuples to arbitrary schema property/item path tuples covering all 13 ^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$ digest sites in conformance/schemas/trace-claim.json.
3. Add schema-parity and real-record acceptance/rejection tests in conformance/tests/test_packaged_schema_accepts_real_records.py:
   • Asserts conformance/schemas/trace-claim.json is byte-identical to ../schema/trace-claim.json when present in the consolidated repository.
   • Asserts valid v0.2 records carrying references, reproducibility, appraisal.re_execution, and appraisal.platform_measurement validate against conformance/schemas/trace-claim.json.
   • Asserts cnf.jwk accepts canonicalizable RFC 7517 extension members (use, key_ops) while rejecting non-canonicalizable floats (1e21, 1.5) and unsafe integers (9007199254740992) via $defs/canonicalizableValue (Implementation findings from the Go verifier (#444): 26 items #448 item 2).
   • Asserts conformance/schemas/trace-claim.json rejects subject: "spiffe://bernstein.run", iat: 9007199254740992, non-canonical 86-char signature, and bare {"kty": "RSA"} cnf.jwk.
4. Align conformance/docs/ and conformance/tests/test_docs_match_the_modules.py (Implementation findings from the Go verifier (#444): 26 items #448 items 5 and 23):
   • Updates conformance/docs/modules/tr-sca.md, conformance/docs/modules/tr-txn.md, conformance/docs/modules.md, conformance/docs/error-codes.md, and conformance/docs/levels.md so TR-SCA-002, TR-TXN-001, and TR-RTE-002 document both sha256: (64 hex chars) and sha384: (96 hex chars).
   • Removes the stale statements in conformance/docs/levels.md claiming TR-RTE-002 rejects all-zero measurements at Level 1, aligning with conformance/docs/modules/tr-rte.md and tr_rte.py (trust-levels: the all-zero measurement convention is stated with two different scopes #240, Implementation findings from the Go verifier (#444): 26 items #448 item 23).

Cold-reader review:

• Checked the initial cnf.jwk rejection test in conformance/tests/test_packaged_schema_accepts_real_records.py against the pre-fix conformance/schemas/trace-claim.json. In the pre-fix schema, cnf.jwk had "additionalProperties": false rather than "$ref": "#/$defs/canonicalizableValue", so a test asserting only that cnf.jwk["ext"] = 1e21 fails would pass against the pre-fix schema for the wrong reason (it rejected every extra member, including valid RFC 7517 members such as "use": "sig"). Split this into test_cnf_jwk_accepts_canonicalizable_extensions_and_rejects_non_canonicalizable_numbers, which first validates a record carrying "use": "sig" and "key_ops": ["verify"] (failing on the pre-fix schema) and then asserts rejection of 1e21, 1.5, and 9007199254740992.
• Also noted that conformance/tests/test_packaged_schema_accepts_real_records.py carried three pre-existing em dashes (U+2014) in its module docstring that lost their conformance/import-manifest.json exemption once the file was edited; replaced them with standard punctuation so python tools/check_dashes.py passes cleanly.

Contributor: Raghuvar Durga (@drk-ram)

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

No change to spec/trace-v0.2.md; synchronizes the packaged conformance copy conformance/schemas/trace-claim.json and conformance/docs/ with schema/trace-claim.json (§3.1, §3.1.2, §3.1.4, §3.1.5, §3.2.2).

Tests for a fix

Each of the following tests in conformance/tests/ fails when the corresponding change in conformance/schemas/trace-claim.json or conformance/docs/ is switched off:

• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_packaged_schema_is_byte_identical_to_normative_schema
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_v02_record_with_references_reproducibility_and_appraisal_extensions_validates
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_cnf_jwk_accepts_canonicalizable_extensions_and_rejects_non_canonicalizable_numbers
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_packaged_schema_rejects_records_forbidden_by_normative_schema[<lambda>-SPIFFE prefix without workload path]
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_packaged_schema_rejects_records_forbidden_by_normative_schema[<lambda>-iat above IEEE 754 MAX_SAFE_INTEGER]
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_packaged_schema_rejects_records_forbidden_by_normative_schema[<lambda>-non-canonical 86-char base64url signature]
• conformance/tests/test_packaged_schema_accepts_real_records.py::TestPackagedSchemaAcceptsRealRecords::test_packaged_schema_rejects_records_forbidden_by_normative_schema[<lambda>-RSA cnf.jwk missing required n and e members]
• conformance/tests/test_docs_match_the_modules.py::test_digest_docs_name_both_sha256_and_sha384
• conformance/tests/test_docs_match_the_modules.py::test_levels_doc_agrees_with_tr_rte_on_all_zero_measurements

Validation commands run:

• pytest conformance/tests -> 727 passed, 5 xpassed
• pytest tests/test_validate.py tests/test_the_schema_and_the_models_agree.py tests/test_conformance_import_style.py -> 43 passed
• ruff check src tests scripts conformance/tests/test_digest_parity.py conformance/tests/test_packaged_schema_accepts_real_records.py conformance/tests/test_docs_match_the_modules.py -> passed (All checks passed!)
• python tools/check_dashes.py -> passed (no dashes outside examples/, spec/trace-v0.1.md)
• mypy src/agentrust_trace -> passed (Success: no issues found in 15 source files)

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)