Add signed-agent proof and clarify verification guide - #85

The existing AI-agent verification guide implied broad provider signing coverage, included an unsourced latency claim and described a denial as an automatic HTTP403 despite middleware starting in monitor mode. Add a reproducible cryptographic proof and revise the guide around the behavior developers can actually inspect.

• Standalone Node20+ fixture pins published @webdecoy/node0.22.3, generates in-memory Ed25519 keys and signs method, target URI and Signature-Agent. Only the public-directory response is injected; verification is the real SDK implementation.
• Verify valid, modified-target, expired, unknown-signer and unsigned cases. Assert the exact statuses/reasons and directory-key reuse; never print/save private keys or call a provider.
• Run a clean standalone install and the verification test through the existing CI command. SDK runtime implementation and workflow permissions are unchanged.
• Link the runnable proof from the root README and explain observation-first Next.js integration, monitor/enforce behavior, category-policy semantics, directory fetching, and identity versus authorization.

Validation: actual demo output and standalone clean-install test passed; all five scenarios matched expected statuses/reasons. Documentation local links and git diff --check pass. This fixture is not provider traffic, a latency/accuracy benchmark or a full Web Bot Auth conformance test.

Full CI: Build (20) and Build (22) passed, including clean standalone installation and all five signature scenarios.