feat: PURL encoding for NATS subject mapping

[jpower432]

Summary

Define an encoding scheme for PURLs in NATS subjects. PURLs like pkg:oci/acme/myapp contain characters (:, /, @) that are invalid in NATS subjects (. is delimiter, > and * are wildcards).

Context

Target-namespaced NATS subjects use dev.complytime.ingest.evidence.<target_id>. If target_id is a PURL, the subject breaks. This needs to be resolved before target-namespaced event routing ships.

Acceptance Criteria

• Encoding scheme defined (e.g., URL-safe base32, hex, or dot-separated segments)
• Round-trippable: decode(encode(purl)) == purl
• Compatible with NATS wildcard subscriptions
• Documented

Relates-to: #152