fix(buy): clearer hint when seller didn't publish on-chain identity

[bussyjd]

Summary

• When agent-registration.json parses successfully but has an empty registrations[], the error now explains why it failed and surfaces --no-verify-identity as the opt-out — instead of the opaque "registration document has no on-chain registrations" message users saw before.
• UX-only change: no security model modifications, no auto-bypass, --no-verify-identity remains the explicit opt-out.

Why

On the v1337 live demo (inference.v1337.org), obol buy inference v1337-aeon --seller https://inference.v1337.org/services/aeon hard-failed because v1337's /.well-known/agent-registration.json has no registrations[] field — the seller never ran obol sell register. The previous error gave no hint that --no-verify-identity exists, forcing users to dig through help text.

This is categorised as a UX gap, not a security bug. The buyer flow's refuse-by-default identity check is correct and unchanged.

Behavior change

Before:

identity pre-flight: registration document has no on-chain registrations

After:

identity pre-flight: seller didn't publish on-chain identity: agent-registration.json has no `registrations[]` field.
This usually means: (a) the seller didn't run `obol sell register` on-chain, or
(b) the seller is on an older obol-stack version that pre-dates the AgentIdentity CRD.
Re-run with --no-verify-identity to buy without identity verification, or contact the seller to publish their agentId.

Test plan

• Updated existing "empty registrations" table row in TestVerifyAgentID to match new substring (no \registrations[]` field`).
• Added TestVerifyAgentIDForPricing_EmptyRegistrations: seller returns valid JSON with registrations: []; asserts error contains both no \registrations[]` fieldand--no-verify-identity`.
• Existing passing cases (valid registrations[{agentId, agentRegistry}]) unchanged — TestVerifyAgentIDForPricing still green.
• go test ./cmd/obol/ ./internal/buy/ ./internal/erc8004/ -count=1 — all pass.
• go build ./... — clean.

Risks

None — message-only change in a single code path. No security impact. The opt-out flag and its semantics are untouched.