Add MCP authorization conformance suite v2

[dinpd]

What changed

• adds an offline MCP authorization conformance suite v2 with 11 deterministic cases
• verifies RS256 authorization evidence through an in-memory JWKS with explicit issuer, audience, algorithm, and key selection
• covers valid execution, action mutation, runtime mismatch, delegation escalation, approval expiry, risk revocation, policy drift, wrong audience, and unknown signing key
• models retry-safe replay of a prior completed closure and partial-to-complete closure correlation
• updates README and standards documentation to position AgentPass as an interoperability and conformance project for action-bound authorization, not a general agent-identity standard

Why

The v1 vector established a basic provider trust boundary. Issue #71 expands that into a broader executable suite and makes the project's reuse-before-invention positioning explicit.

Impact

The new suite is experimental and non-normative. It makes no production API changes, adds no dependencies, uses no live provider or identity service, and writes or prints no private key or JWS. Passing it means agreement with AgentPass reference cases, not certification by an external standards body.

Acceptance and validation

• python scripts/run_mcp_authorization_conformance_v2.py fixtures/mcp-authorization-conformance-v2/vector.json — all 11 cases matched
• python -m pytest -q — 104 passed
• deterministic double-run assertion — passed
• Python compile check — passed
• fixture and result JSON parse checks — passed
• whitespace/diff check — passed
• manual trust-boundary and secret review — no findings

Dedicated static/security scanners were not installed. python -m pip check reports pre-existing global environment conflicts for aider-chat and open-interpreter; this change adds no dependencies and the repository suite passes.

Closes #71