Trusteed Agentic Commerce for Magento v1.2.0

Security and correctness release.

• Security fix — the agent token verifier treated exp, iat and nonce as optional. Both time checks hung off > 0, so a token that simply omitted the claim skipped expiry and max-age entirely: it was valid forever. All three claims are now mandatory (nonce 16–64 chars).
• Security fix — the enforcement snapshot's signed freshness window (validUntil) was ignored, so an expired snapshot was applied as if current. Magento was the only connector that did not check it. Expired now means absent, and the merchant's fallback policy applies.
• Fix — trust scores with a decimal rendered as "no score" (the Health tab used is_int() on a value the engine rounds to one decimal). Measured across production stores on 2026-07-27: 44.7, 52.7, 55.7, 61.5 and 81.4 all showed as "no score".
• Fix — rule R036 read its cap from maxCents; the canonical parameter is maxCentsPerLine, so the rule could never fire.
• Added — capability reporting, so the merchant panel can warn when a rule is switched on whose signal this installation cannot provide.

Full changelog in the README (also available in Español, Français, Deutsch).