Add dynamic discovery + delegation proof record types

[davidahmann]

Summary

• add built-in dynamic_tool_discovery record type with required runtime discovery fields:
  • discovery_method (webmcp|a2a|dynamic_mcp)
  • declared tool annotations (readOnlyHint, destructiveHint)
  • policy_verdict
• add built-in delegation record type with required delegation accountability fields:
  • delegator_id, delegatee_id
  • delegation_scope, chain_depth
  • delegator_policy_digest, delegatee_policy_digest
  • verdict
• document optional metadata.discovery_method context key values:
  • static, webmcp, a2a, dynamic_mcp
• update built-in record type inventory docs from 16 to 18
• add schema tests for valid/invalid payloads for both new types

Validation

• make prepush-full
  • fmt + lint + unit tests
  • coverage and package coverage gates
  • contract checks
  • integration/e2e/acceptance
  • hardening/chaos/performance/soak/scenarios