0.22.1 — advertise VGI-Proxy-Proof-Required

A require-mode worker now tells proxies it actually enforces the proof they mint.

Without the header there is no confirmation step in the allow → require rollout: a proxy minting proofs at a worker that silently ignores them looks identical to one that checks every hop. The proxy-proof spec has required it since vgi-rpc 0.28.0 (§2.2), but no implementation emitted it and no test caught that.

What changed

create_app(proxy_proof_required=...) defaults to None, deriving the posture from VGI_PROXY_PROOF_MODE — the same env var _resolve_proxy_proof_gate reads, so the advertisement cannot drift from the gate it describes. Pass a bool explicitly only when supplying a hand-built gate via authenticate.

Verified against a real waitress-served worker: off and allow emit nothing, require emits "true".

Requires

vgi-rpc 0.28.3, which adds the make_wsgi_app kwarg plus two shared conformance cases pinning both postures. All five language ports emit the header as of that release.