fix: require issuer for v0.2 manifests (was silently optional like legacy v0.1)

[rajnisht7]

What

Scopes the "missing issuer is OK" schema exception to v0.1 manifests only, so v0.2 manifests without issuer correctly fail verification instead of coming back VALID.

Why

_strict_schema_violations() in _verify.py was filtering out the missing-issuer schema error for every manifest version, with no version check. The exception was only ever meant for legacy v0.1 records (which predate the issuer field). Since the v0.2 spec makes issuer REQUIRED, and it's used elsewhere for signing-key authorization, a v0.2 manifest with issuer stripped out could carry a valid COSE signature and still verify as VALID silently dropping that authorization check.

Spec impact

None

Test plan

• pytest -v passes
• mypy src/agent_manifest passes
• ruff check src/ tests/ passes
• New or updated tests cover the change
• If spec change: CHANGELOG.md updated

DCO

All commits in this PR are signed off (git commit -s). By submitting this PR I certify the Developer Certificate of Origin.

[imran-siddique]

Reviewed 367d0c0.

The issuer omission exception is now limited to legacy version 0.1. Full local suite: 1,495 passed, 6 skipped, 1 expected failure. I reverted only this condition in an isolated worktree: both new v0.2 tests then failed because verification returned VALID, while the v0.1 compatibility control passed. Restored the exact reviewed tree afterward. This establishes the schema rejection without breaking the legacy path; current hosted CI is passing apart from the review gate.