Refactor git shellouts to libgit2

[bordumb]

Overview

This PR implements the transition from shell-out git subprocess commands to native libgit2 (via git2-rs) for core KERI/commit operations as specified in the PRD.

Changes Made

• Evidence Chain Blob Extraction (org.rs, verify_commit.rs, commit_signing.rs):
  • Replaced git cat-file commit with in-process git2::Repository::odb().read() for securely reading raw commit bytes for signature verification.
• Agent Registry Materialization (chain.rs):
  • Rewrote the subtree isolation operations (git read-tree, git rm --cached, git commit-tree, git update-ref) using git2's index, tree, and commit APIs.
• MCP Gateway Chain Operations (auths-mcp-gateway/src/chain.rs):
  • Swapped git init, git add, and git commit with their git2 equivalents for creating per-call and per-settlement signed evidence commits.
  • Subprocess boundary for auths sign HEAD is strictly preserved to ensure key management and SSH agent workflows function exactly as before.
• Dependencies (auths-sdk):
  • Added git2 as a native-only (cfg(not(target_arch = "wasm32"))) dependency to preserve WASM compilation capabilities.

[github-actions]

Auths Commit Verification

Commit	Status	Details
0d813961	❌ Failed	Signing key is not the device's current key

Result: ❌ 0/1 commits verified

---

How to fix

Commit 0d813961 failed verification. See the Actions log for details.