Verify the frozen signature v1 profile

[jt55401]

Summary

• verify the exact RFC 8785 v1 payload and URL scope
• preserve raw response source for parser and duplicate-attribute checks
• enforce algorithm, key, signature-width, timestamp, claim, and resource limits
• preserve resolver policy failures and use browser-equivalent Node parsing
• pin canonicalization v0.3.0 at b0c8f305

Validation

• clean npm ci
• npm run typecheck
• npm run build
• npm test (51 passing)
• git diff --check