fix(security): issuer binding + fail-closed verification (SOC-32, SOC-35)

[chongkan]

Summary

Security release for @attestto/vc-sdk (v0.2.0 → 0.3.0). Verification was fail-open and not bound to the issuer, so an unsigned/unresolvable credential could report valid: true (SOC-35), and a credential could claim a trusted issuer while signed by an attacker's unrelated key (SOC-32). Both are now closed, fail-closed by default. Closes SOC-32, SOC-35.

SOC-32 — issuer binding

checkProofs now returns allValid && issuerBoundValid: every proof must verify and at least one valid proof must be bound to credential.issuer — either the proof's verificationMethod DID equals the issuer, or the optional VerifierConfig.verifyIssuerBinding(issuer, verificationMethod) hook authorizes it (DID-document assertionMethod delegation; fails closed if the hook throws). Multi-party co-signers from other DIDs remain supported (they must also verify). Blocks the "claim a trusted issuer, sign with your own key" forgery.

SOC-35 — fail-closed verification

Missing proof, missing resolver, unresolved key, or bad signature now push errors (not warnings), so valid can never be true for an unverifiable credential. Adds VerificationResult.signatureVerified and VerifyOptions.requireSignature (default true).

Breaking change (consumers)

valid: true now requires a verified signature bound to the issuer:

• Callers relying on the fail-open path (proof present, no resolver → valid) must supply a resolver or set requireSignature: false.
• Delegated signing keys: if verificationMethod's DID differs from issuer (e.g. issuer did:web:x signing with a separate assertionMethod key), you MUST provide verifyIssuerBinding or the default direct-binding check rejects it. cr-vc-sdk (SOC-16/19) and attestto-app (SOC-10) must wire this hook if they use delegated keys.

Verification

• 155/155 tests pass (+7 security, incl. a genuine forgery — valid attacker signature with mismatched issuer → rejected; multi-party co-signing still works).
• tsc --noEmit clean, tsup build green. CHANGELOG updated (Keep a Changelog / SemVer).

Note

Also bumps to 0.3.0 and adds @vitest/coverage-v8 dev dep (+ lockfile, kept consistent) so pnpm test:coverage works — the security change itself is src/verifier.ts + src/types.ts + the new tests/verifier-security.spec.ts.