feat(indexer): resolve DACS-5 bundle bindings

[randomblocker]

What changed

• derives the DACS-5 role-specific logical bundle address and verifies signed BundleBinding records under dacs-bundle-binding:v1:
• discovers BB-4-valid bindings from chain artifacts, bounded registration carriage, and the optional hash-bound DACS-1 well-known binding index
• resolves current buyer/seller copies through BB-5 and the BB-6 standing ladder, with deterministic ordering, outsider pre-fetch pruning, an N=8 per-signer fetch budget, and sticky fail-closed total-cap overflow
• stops registration-supplied native pointers from acting as resolution authority for current-profile reputation
• adds the unauthenticated normative GET /api/dacs/bundles/{jobId} catalog surface and advertises it in discovery/OpenAPI
• adds v0.3 FaultAttestationBundle verification under its distinct signature domain and absolute-fault constraints
• bumps scan state to v7 so existing history is replayed for BundleBinding discovery

Why

DACS-5 v0.3 §10.4.2, merged in DACS-Standard PR #248, requires Demos consumers to derive the logical role address and resolve the native StorageProgram through a verified BundleBinding. The directory previously consumed registration/native scanner pointers directly. Although the fetched bundles were cryptographically checked, those pointers did not establish the normative logical-to-native mapping and could not implement BB-6/BB-7 multiplicity and indeterminate semantics.

Impact

Current-profile deals without resolvable buyer and seller BundleBindings now fail closed and do not contribute to reputation. Legacy SDK artifacts remain on their explicitly labelled compatibility path. The v7 deployment replay can temporarily make indexing take longer while historical binding candidates are rediscovered.

BB-4 key resolution in this reference directory is intentionally scoped to its canonical self-describing did:demos:agent:<64hex> claim profile. Other ClaimReference methods remain unsupported and fail closed to indeterminate; this PR does not claim a universal DID/key resolver.

Validation

• npm run typecheck
• all 174 directory tests passed (172-test main batch plus the two publisher tests run separately)
• npm run build
• git diff --check

Closes #77