docs(spec): map Agent Manifest onto SCITT terms (section 10.5)

[imran-siddique]

Makes "agent-layer profile of SCITT" a checkable claim instead of a slogan. Follows #242, which settled the envelope.

New section 10.5

Every structural piece of this spec already has an RFC 9943 name. Stating the correspondence tells an implementer which parts are agent-specific and which are inherited:

SCITT term	Agent Manifest
Artifact	the deployed agent
Subject	agent_id
Statement	the manifest document
Issuer	issuer
Signed Statement	the signed manifest (COSE_Sign1 from v0.2)
Transparency Service	the Rekor or consortium log
Receipt	the inclusion proof in transparency_log_entry
Transparent Statement	a manifest with that field populated
Registration Policy	conformance level, issuer-key authorization
Auditor	a third party reconstructing history from the log

The correspondence is real rather than aspirational: Section 3.6 already mandates reaching Transparent Statement for production ("the signature is NOT sufficient without the transparency_log_entry for regulatory purposes"). The agent-specific contribution is the Statement payload, sections 3.2 through 3.5, which is what it takes to describe an agent completely enough that a third party can tell whether the one running is the one approved. Everything around it should be read as SCITT rather than as a parallel invention.

What the spec deliberately does not restate

• The model artifact: OpenSSF Model Signing. OMS produces a detached bundle in Sigstore Bundle Format listing every model file by digest, covering weights, config, and tokenizer as a unit. We bind model_identity to the deployed model; where a publisher ships an OMS bundle, model_hash should be the digest OMS binds so the two agree by construction. Added as a 10.4 row, plus a v0.2 line item for an explicit bundle reference so a verifier can follow the chain from agent to model publisher rather than trusting an operator-asserted hash.
• Build provenance: SLSA and in-toto, referenced by supply_chain (3.2.8).
• Transparency: SCITT and Sigstore, as mapped above.

Net effect is that adjacent efforts become dependencies rather than competitors, and the remaining gap is the one none of them covers: no existing standard binds a system prompt, policy bundle, tool catalog, memory baseline, delegation chain, and human approval into one hardware-attestable artifact.

Verification

SCITT terms and their definitions were taken from RFC 9943 itself, not from memory. Cross-references in the new section were checked against the spec (supply_chain is 3.2.8 not 3.2.9; the section 3.6 transparency sentence quoted above exists at line 937).

618 tests pass. No code in this PR.