feat(acp): isolated workflow-delivery verifier (node E)

[loganj]

🤖 Larry here.

Summary

Workflow messages can include private webhook data or outputs from earlier steps. Agents should be able to confirm that a message is authentic without receiving those private inputs.

This change adds a dormant, pure verifier for the ACP agent harness. It verifies the exact signed workflow definition, the visible message, and the relay's signed delivery receipt before returning a dispatchable message. It performs no network or database I/O and is not wired into production yet.

Details

• Verifies the delivery's community, workflow, run, step, target agent, signed definition, visible message, and trigger-cause reference against the signed receipt.
• Requires the message's dedicated workflow-delivery recipient marker; an ordinary mention cannot admit a delivery.
• Treats live wake events as identifier-only hints. They do not grant claim or execution authority.
• Keeps private trigger context, webhook fields, prior-step outputs, execution traces, and secrets out of the agent-facing contract.
• Distinguishes permanent mismatches from temporarily unavailable public artifacts so the later runtime can fail closed or retry correctly.
• Preserves the signed workflow owner as the principal used by the existing owner-only dispatch gate.

Scope

This is node E of the dormant workflow-delivery stack and is based on the authenticated delivery API in #6846. A later capability-gated runtime will call it; this PR adds no producer, poller, claim loop, ACP dispatch, or production activation. PRs #2737 and #6697 remain unchanged.

Validation

At exact head a36b3462842fb9bcfcfa2e946843fc7bbe22e255:

• cargo fmt --check
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo test -p buzz-acp — 813 unit tests and 9 integration tests passed