test: add algorithm agility vectors for signed agent card verification - #1438

Signed Agent Cards carry a detached JWS over the RFC 8785 canonical card. create_signature_verifier takes an explicit list of acceptable algorithms so the algorithm named in a protected header cannot steer verification outside the chosen set. That list is the control that stops algorithm confusion and it is the seam a future algorithm extends. The present suite covers a correct key, a wrong key, a tampered card and malformed protected headers. It does not yet pin the list itself.

This change adds a focused test module that pins that behavior. Nothing under src changes and no dependency is added.

The new vectors assert that a genuine ES256 signature verifies when ES256 is on the list, that an ES256 signature is rejected when ES256 is absent from the list, that an HS256 signature is rejected against an asymmetric public key which is the classic algorithm confusion case, that the unsecured none algorithm is rejected even when a caller names it, that a protected header with no alg is rejected over genuine signature bytes and that an algorithm which is named but not registered is rejected even when it appears in both the header and the list.

The final case uses the FIPS 204 ML-DSA name to record a post quantum readiness property. A verifier does not accept an algorithm by name alone, so adding ML-DSA later stays additive and gated behind a caller opt in and a real registered implementation.

All tests pass and coverage stays above the gate.