Ship PeacEvidenceCarrier types (Layer 0, zero runtime) and Zod schemas
with shared computeReceiptRef() helper (Layer 1). Includes carrier
conformance fixtures (5 valid, 3 invalid) and verifyReceiptRefConsistency()
for DD-129 async extraction enforcement.

- kernel: PeacEvidenceCarrier, CarrierAdapter<T,U>, CarrierMeta types
- kernel: PEAC_RECEIPT_HEADER canonical constant (DD-127)
- schema: ReceiptRefSchema, CompactJwsSchema, PeacEvidenceCarrierSchema
- schema: computeReceiptRef() with WebCrypto runtime guard
- schema: validateCarrierConstraints() transport-aware validation
- schema: verifyReceiptRefConsistency() for tamper detection
- schema: CARRIER_TRANSPORT_LIMITS per-transport size constants
- conformance: 8 carrier fixtures in specs/conformance/fixtures/carrier/
- conformance: carrier category registered in manifest and tracking

* feat: discovery profile spec and 3-step algorithm (DD-110)

Discovery Profile (docs/specs/DISCOVERY-PROFILE.md):
- 3-step discovery algorithm: Agent Card -> well-known -> header probe
- SSRF protection requirements per Polish C
- PeacDiscoveryResult type with source attribution
- Caching recommendations and security considerations

Discovery code (@peac/mappings-a2a):
- discoverPeacCapabilities(): implements 3-step algorithm
- discoverPeacWellKnown(): /.well-known/peac.json discovery
- discoverPeacViaHeaderProbe(): HEAD request with PEAC-Receipt check
- PeacDiscoveryResult, PeacDiscoverySource types
- 8 new tests (24 total discovery tests)

* feat: strict discovery surface contract with shared JWKS resolver

Enforce the canonical 3-step JWKS resolution algorithm:
iss -> peac-issuer.json -> jwks_uri -> JWKS

- Add shared jwks-resolver.ts: single cache, strict discovery, 6 new
  kernel error codes (E_VERIFY_ISSUER_CONFIG_MISSING, _INVALID,
  _MISMATCH, JWKS_URI_INVALID, INSECURE_SCHEME_BLOCKED, JWKS_INVALID)
- Rewrite verify.ts to delegate to jwks-resolver (remove legacy
  fallback paths, local JWK/JWKS types, parallel cache)
- Rewrite verifier-core.ts to delegate to jwks-resolver (remove
  private fetchIssuerConfig, private cache, direct SSRF fetch)
- Add discovery surface drift guard to guard.sh (scoped to
  packages/protocol/src/*.ts production code)
- Update PEAC-ISSUER.md: strict key discovery section, new error table
- Update PEAC-TXT.md: peac.txt MUST NOT be used for key discovery
- Update docs/receipts.md and docs/ARCHITECTURE.md references
- Add 19 tests covering all error codes, caching, and no-fallback

* fix: discovery SSRF hardening and AGENTS.md A2A v0.3.0 alignment

Discovery (P0-2, P0-3, P1-A, P1-C):
- Add resolveHostname option for portable DNS rebinding defense
- Replace blanket proxy bypass claim with accurate proxy policy
- Add userinfo rejection (user:pass@host URLs blocked)
- Add RFC 8174 reference alongside RFC 2119 in normative keywords
- Spec sections 4.1, 4.7, 4.8 updated to match implementation
- 4 new tests: userinfo rejection, DNS rebinding (2), public IP pass

AGENTS.md (P1-B):
- Update A2A Agent Card example to v0.3.0 capabilities.extensions[]
- Fix discovery path to /.well-known/agent-card.json (v0.3.0 canonical)
- Update JWKS path to /.well-known/peac-issuer.json

* fix: JWKS resolver spec alignment and formatter corrections

Post-commit formatter corrections for JWKS resolver changes:
- PEAC-ISSUER.md: canonicalize issuer to origin, stricter jwks_uri validation
- guard.sh: updated discovery surface drift patterns
- Protocol test and implementation alignment

* fix: JWKS resolver improvements (issuer normalization, error taxonomy, LRU cache, drift gate)

New error codes added in this branch (JWKS resolver, issuer config,
insecure scheme) were missing from the generated TypeScript file.