Add example: cryptographically verifiable AgentFacts trust fields via Attestix

[ascender1729]

Problem

certification and evaluations (auditTrail, auditorID) are reserved for trust, but the format ships no way to prove them. They are plain strings any publisher can write anything into. A consumer reading certification.level: "EU-AI-Act-Annex-III" cannot tell a real audit from a self-asserted claim.

Change

A self-contained, runnable example (examples/attestix_verifiable_agentfacts/) that makes those fields cryptographically verifiable using Attestix (Apache-2.0):

1. Attestix issues an Ed25519-signed W3C Verifiable Credential about the agent.
2. certification / evaluations.auditTrail / evaluations.auditorID are populated from that credential; the credential travels with the doc under x-attestix-credential (extra top-level properties are allowed by the schema).
3. Anyone verifies offline, with no call back to the issuer, that the signature is valid and that the visible certification fields match exactly what was signed. A publisher cannot upgrade their own certification.level without detection.

Verified

Run against attestix 0.4.1 + jsonschema 4.26:

[PASS] AgentFacts validates against agentfacts_schema.json
  [PASS] credential signature valid
  [PASS] credential is about this agent
  [PASS] certification.level matches signed claim
  [PASS] certification.issuer matches signer
  [PASS] certification dates match the credential
  [PASS] evaluations.auditorID matches signer
  [PASS] evaluations.auditTrail points to the credential
  [PASS] forged certification.level is REJECTED offline
  [PASS] forged certification.expirationDate is REJECTED offline

The script generates agent.agentfacts.json locally (gitignored output) and ships with a README.

Field mapping

AgentFacts field	Filled with
certification.level / issuer / dates	the signed credential's claim, issuer DID, validity window
evaluations.auditorID	the Attestix issuer DID
evaluations.auditTrail	the credential id (pointer to the verifiable evidence)
x-attestix-credential	the full signed credential, so verification is offline

Context

This is the AgentFacts side of the Attestix ↔ NANDA integration Prof. Raskar asked us to demo. A companion PR to projnanda/adapter adds optional attestation to the agent-registration handshake. Happy to adapt either to your preferred repo/path or sign a CLA (I don't see a LICENSE file yet).

Opened as a draft for discussion, not asking for a merge yet.