The one attestation rule with no adversarial mode is the one about a scheme we cannot check

[macanderson]

The problem

F8 is the one attestation guarantee with no adversarial mode behind it.

SPEC.md §6.5 F8 says a verifier that does not recognise an attestation's
algorithm MUST report it as uncheckable and MUST NOT treat the frame as
attested — "I cannot check this" is never "this is good". PR #154 added the
attestation conformance check and five --misbehave modes covering F6, F7 and
F9. F8's path through that check is written and exercised by nothing:

• contextgraph-conformance/src/lib.rs, attestation_stdio_probe — the
  AttestationVerdict::UnknownAlgorithm arm collects the frame as uncheckable
  rather than as a failure, and the check skips when every attestation was
  uncheckable.
• No --misbehave mode makes a provider serve one, so neither branch has ever
  run against a real provider.

The unexercised branch is the one that matters. A provider that wrote
"algorithm": "magic" on every attestation would today make the check report
Skipped — which .github/scripts/conformance-external.sh treats as a failure
and conformance-green.sh treats as a failure, but which
ConformanceReport::passed() treats as a pass. Three consumers, two answers,
and nothing has ever produced the input that tells them apart.

What is needed

A sixth mode, unknown-algorithm, in
contextgraph-conformance/src/bin/contextgraph-example-docs.rs: sign honestly,
then overwrite attestation.algorithm with a scheme this build cannot check
(the existing unit test uses "dilithium3"). Its doc comment names the check it
trips, which is how .github/scripts/conformance-red.sh derives the expectation
— no script edit is needed.

Then decide, and write down, what the check should report. The two candidates
both have a real argument:

• Skip. CheckStatus::Skipped already means "not applicable to this
  provider/transport", and a provider on a post-quantum scheme is not broken —
  it is uncertified here. This is what the code does today.
• Fail. A conformance verdict is "green on this suite", and a suite that
  green-lights signatures it never checked is the self-attestation §11.1 exists
  to rule out.

Whichever is chosen, conformance-red.sh must agree with it: that script fails
a mode that "passed every check", and a Skipped counts as not-passed there, so
a skip verdict happens to satisfy it today by accident rather than by decision.

Files

• contextgraph-conformance/src/bin/contextgraph-example-docs.rs — the
  Misbehave enum and attestations_for.
• contextgraph-conformance/src/lib.rs — attestation_stdio_probe's
  UnknownAlgorithm arm and its all-uncheckable skip.
• contextgraph-conformance/tests/conformance_suite.rs — the per-mode tests;
  attestation_mode_is_caught is the helper the five existing modes use.
• .github/scripts/conformance-red.sh, conformance-green.sh,
  conformance-external.sh — the three consumers that disagree about a skip.

Reproduce

cargo build -p contextgraph-conformance --bins
# there is no mode to run; the branch is reachable only by hand-editing the fixture
rg -n 'UnknownAlgorithm' contextgraph-conformance/src/lib.rs

Definition of done

• --misbehave unknown-algorithm exists and its doc comment names the check
  it trips.
• The chosen verdict (skip or fail) is implemented, and the reason it was
  chosen over the other is written in attestation_stdio_probe's doc
  comment, not only in this issue.
• A test asserts the mode produces that verdict and names UnknownAlgorithm
  in the evidence, not merely "not a pass".
• conformance-red.sh catches the mode, and its treatment of a Skipped
  check is a stated decision rather than an accident.
• conformance-green.sh and conformance-external.sh still pass for every
  provider in CI.