Add TypeScript TRACE finalization

[imran-siddique]

What changed

• add TypeScript TRACE v0.2 claim derivation from sealed, complete evidence
• require a caller-supplied official codec for signing, structural validation, public-key derivation, and self-verification
• fail closed on incomplete evidence, missing trust inputs, conflicting policy bindings, missing/unranked data classification, or codec failure
• derive policy binding, maximum data class, appraisal, issuance time, software-only measurement, and optional tool transcript
• standardize Python and TypeScript tool-transcript hashing on RFC 8785 JCS

Why

No official AgentTrust TRACE package currently exists on npm. Implementing a local shape check would overstate conformance. A strict codec boundary makes the orchestration usable without pretending the telemetry SDK is the official cryptographic validator.

Impact

TypeScript now covers the same telemetry-to-TRACE derivation flow as Python when supplied an official codec. The SDK still never loads or generates a signing key and never manufactures hardware attestation.

Validation

• python -m pytest -q — 93 passed, 21 subtests passed
• npm run check — build, 41 tests, package dry run passed
• shared Python/TypeScript RFC 8785 transcript digest asserted
• schema, version, OTel matrix, and conformance gates passed
• exact installed-tarball export smoke test passed