test(runtime-evidence): add external signer context vector

[altrudev]

Adds the missing consumer-side trust-context case discussed on #277.

The runtime-evidence corpus already covers:

• forged quote -> reject
• valid quote with mismatched runtime.measurement -> reject

This PR adds the separate signer-trust boundary: a record may verify its own signature under its embedded cnf.jwk and still fail to establish signer trust under the relying party's externally configured trust roots.

The committed vector keeps those dimensions separate:

• runtime evidence: platform-attested
• model claim: self-reported
• signer trust: not-established

The verifier context is intentionally non-empty and contains a real deterministic but different trusted Ed25519 key. The test proves:

1. the record envelope is internally valid under the embedded key;
2. the embedded key is not one of the configured trusted roots;
3. the configured trusted key cannot authenticate the record signature.

The vector metadata is data-driven; generate.py has no filename-specific special case.

No runtime-grade algorithm change and no schema change.

AI-assistance disclosure: ChatGPT assisted with DDC radial analysis, implementation drafting, and test design. altrudev reviewed the bounded claim and remains responsible for the contribution.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[rajnisht7]

the name of the file is reject-embedded-key-as-trust-root but the grade is platform-attested, not reject. All other reject-* vectors actually fail. kindly rename it

The record is full copy of accept-real-quote-platform-attested.json. Only the extra signer_trust / empty trusted_root_keys fields are new. That’s okay for a trust-context example, but the name should not say “reject”

In test_embedded_key_is_not_external_verifier_context, trusted_root_keys is always [], so embedded not in configured always passes.

there is hard-coded name in generate.py Special-casing if name == "reject-embedded-key-as-trust-root" is fragile. Please make context / extra expected fields part of the normal vector data instead.