Claim runtime: enforce value.type conformance for extract and exists rule results

[jeremi]

REQ-DM-CLAIM-009 (RS-DM-CLAIM) states an evaluated value MUST conform to the declared value.type or evaluation is refused. The runtime enforces this only for cel rules (validate_claim_value_type in crates/registry-notary-server/src/runtime.rs); the extract path returns the raw source field with no type check, so a claim declared boolean can evaluate to a string and flow into claim results and credentials.

Fix: apply validate_claim_value_type to the extract/exists paths as well (or narrow the REQ and document the divergence, but enforcing is the better outcome). Add tests for a type-mismatched extract result being refused.

Found during the spec-layer review (docs/site/src/content/docs/spec, 2026-07-07). RS-DM-CLAIM's Limitations section will reference this issue until fixed.

[jeremi]

Triage update (2026-07-14): completed on main through #345. Extract and exists rule results now pass through validate_claim_value_type, with mismatch coverage in the modularized runtime tests. Closing as completed.