Add WebAuthn approval proof profile

[renezander030]

Summary

• add an optional webauthn-es256 proof profile for high-assurance authenticated web approvals
• bind the passkey challenge to the RFC 8785/SHA-256 digest of the complete unsigned ApprovalRecord, including its action, payload, and review-snapshot hashes
• verify exact client data, origin and RP scope, UP/UV flags, counters, P-256 key, ES256 signature, and digest-addressed credential-registration evidence
• add a deterministic real assertion fixture plus tamper-focused conformance vectors
• publish the additive contract as v2.1.0 while retaining v2.0 records against their original schemas

Trust boundary

This provides independently verifiable cryptographic attribution when credential registration/state evidence is retained outside the audited platform. It does not prove that a platform-controlled browser faithfully rendered the bound review snapshot; trusted client presentation remains an explicit deployment boundary.

Validation

• python scripts/generate_examples.py
• python scripts/validate_contracts.py
• python -m unittest discover -s tests -v
• deterministic regeneration check
• pip check

Closes #1