@x402r/evm: type the attestor identity response

[A1igator]

Problem

`packages/evm/src/extensions/attestation/server.ts` returns the attestor's identity as `{ info: { identity: await res.json() } }` — `identity` is `unknown`. Every arbiter invents its own shape, which means:

• Clients consuming the 402 can't rely on any field being present without narrowing.
• Convention drifts between implementations (each arbiter picks its own names).
• New fields (like the `url` advertisement added in garbage-detector: advertise arbiter URL + README fixes arbiter-examples#12) are private handshakes rather than SDK-blessed conventions.

Example shape shipped by the garbage-detector arbiter in that PR:

```ts
{ arbiter, url, provider, operator, chains, description, skills, paymentScheme }
```

Proposal

Define a loose base `AttestorIdentity` type in `@x402r/evm` with optional common fields and an open index signature:

```ts
export interface AttestorIdentity {
arbiter?: Address;
url?: string;
paymentScheme?: { cli?: string; [k: string]: unknown };
description?: string;
skills?: string[];
provider?: string;
operator?: Address | null;
chains?: number[];
[key: string]: unknown;
}
```

Have `createAttestationExtension`'s server return `{ info: { identity: AttestorIdentity } }` so both servers and clients get autocomplete for the SDK-blessed convention while remaining open for arbiter-specific extensions.

Why this matters

• The `url` advertisement pattern added in garbage-detector: advertise arbiter URL + README fixes arbiter-examples#12 becomes a first-class SDK convention rather than a private contract.
• Downstream tooling (clients, CLI, third-party discovery) can reason about identity without per-arbiter knowledge.
• Keeps the escape hatch (index signature) so arbiters can ship domain-specific fields.

Context

Discovered while reviewing BackTrackCo/arbiter-examples#12 (tracked as one of the SDK-level follow-ups from that PR).