fix(rvf): fail closed without executable trust anchor

[proffesor-for-testing]

Summary

• fail strict verification for signed executable segments when no trusted key is configured
• fail executable verification for unsupported signature algorithms
• retain Skip/escalation semantics for signed non-executable metadata
• document the strict execution contract in ADR-155

Fixes #20

Verification

• cargo fmt --check
• cargo test -p rvm-rvf (100 passed)
• cargo clippy -p rvm-rvf --all-targets -- -D warnings
• cargo check --workspace

TDD evidence

The two executable trust regressions failed against the pre-fix implementation, then passed after the eligibility change.