feat: complete the verify surface: anchors, walks, payments subpaths

[creatornader]

Executor package closing everything that queued behind the four-day verify-surface lock, per the in-branch charter (docs/verify-surface-charter.md).

Punch-list remainder (deliverable A): opt-in Rekor / RFC 3161 / OpenTimestamps HTTP transports behind AnchorTransport (offline-mocked tests, non-networked default posture); anchorTrust / proofBundle wiring on verifyRecord surfacing anchor_plurality without changing envelope or delegation result shapes; generated corpus pins across five families (evidence hash-mismatch + sanitization, per-anchor binding negatives + malformed-vs-unknown precedence, checkpoint consistency negatives + foreign-context leaf, delegation malformed-key/ambiguity/depth, initialize-time extension gating); the §6.3 delegation directory walk with principal_identity_resolution and the §1.11.4 run_key_in_directory fact.

Payments step one (deliverable B, deferred from D147): @atrib/agent/payments and @atrib/verify/payments subpath exports with root re-exports + deprecation JSDoc; caller-supplied detectTransaction precedence; verify-side reference consumption of both payments envelope families.

Gates: build green; full recursive tests green (verify at 647 tests); doc-sync 14/14; focused corpus suite 118 tests; Python suite 258 passed (the executor updated the shared-corpus Python consumer per the both-implementations rule, and the reviewing session ran the gate its sandbox couldn't). No dependencies added; no new decisions — the OTS pending-receipt ownership question is escalated in the report, not decided.

Unblocks nothing further: this is the final package of the redesign punch list.