Revise Agent Delegation 1.0 from alink's implementation feedback, and port
the changes to the TypeScript, Rust, and Python SDKs.

Principal identity (spec 5.1-5.4): principal.id is the canonical identifier
and events must name it, never an alias. Resolution is now an algorithm: at
most 5 HTTPS hops, cross-origin redirects allowed, and a document is
authoritative only when read at its own `id`. A document served elsewhere is
a copy whose `controllers` are discarded before re-resolving `id` once --
without that rule any origin could publish another principal's `id` with its
own controller keys. New `aliases` field covers handles and legacy URLs; an
alias is an entry point, never an identity, and must be listed in the
canonical document before a client shows it as a name.

Query privacy (spec 8.6): a public query is an existence check and must carry
both `subject` and `principal_id`. Omitting either side enumerates one party's
delegation graph and must be authorized by that party or refused. Renames
`delegations_url` to `delegation_query_url`.

Drops `status_url` from credential documents, query results, and Profile
delegation hints, which also lose `credential_url`. Credential documents are
unsigned service views, so a status URL carried inside one is chosen by
whoever presents it; status is now resolved through the principal document
instead. Future Work notes service-signed credentials as the way back to a
self-contained pointer.

Authentication (spec 8.1): all endpoints are public and unauthenticated,
authority comes from the envelope signature, and an access token is never a
substitute for envelope verification. Enumeration queries are the exception.

SDKs gain validatePrincipalResolution/is_principal_alias equivalents and
two-step principal resolution in every DelegationClient; query validation
enforces public mode with an allow_enumeration escape hatch for authorized
server-side callers. Versions bumped to 0.6.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>