Freeze HTMLTrust signing profile v1

[jt55401]

Summary

• freeze the versioned JCS signing object, profile identifiers, location scope, strict timestamp grammar, and safe signed-URL policy
• bind key ID, algorithm, content and claims hashes, scope, location, and profile constants into the Ed25519 vector
• align the W3C element, lifecycle API, error vocabulary, and authoring requirements with the six required v1 attributes
• make vector and ReSpec checks self-contained and document downstream implementation gaps

Verification

• scripts/check.sh in node:22-bookworm
• scripts/check-w3c.sh in the pinned Playwright browser image
• scripts/render-ietf.sh, with identical XML, HTML, and text hashes across consecutive renders
• git diff --check main...HEAD