audit-registry: model and provider registry so attestations reference known identities

[joelpeace48-cell]

Problem

An attestation naming a model_id and model_version proves only that the
submitter claimed those values. Nothing binds a model identity to the provider
that owns it, so any submitter can attest as any model — including a
competitor's.

What to do

• register_model(model_id, owner: Address, metadata_hash) — owner authorizes.
• Attestations referencing a registered model must be submitted by the owner or
  an address the owner has delegated to.
• Support delegation: a provider authorises specific gateways to attest on its
  behalf, revocably.
• Allow unregistered models, but mark those attestations as unverified so
  consumers can distinguish. Do not silently accept them as equivalent.
• Metadata (card, licence, provenance) stored as a hash pointing off-chain.

Acceptance criteria

• Model registry with ownership and revocable delegation
• Attestations against registered models enforce the ownership chain
• Unregistered attestations explicitly flagged, not rejected
• Tests: unauthorized attest, revoked delegate, unregistered path

Notes

This is what turns an attestation from a claim into evidence. Without it the
audit trail proves someone wrote something down, which is not the product.

[bobo-24]

Hi! I’m a full-stack developer with a strong blockchain background, and I’m confident I can resolve this issue quickly and effectively. I’ll deliver a clean, reliable solution with immediate attention to detail, ensuring it’s completed as soon as possible. Please assign it to me—I’m ready to get started right away.