Add Authority Advisory AI and API Lifecycle Configuration

- Introduced AuthorityAdvisoryAiOptions and related classes for managing advisory AI configurations, including remote inference options and tenant-specific settings.
- Added AuthorityApiLifecycleOptions to control API lifecycle settings, including legacy OAuth endpoint configurations.
- Implemented validation and normalization methods for both advisory AI and API lifecycle options to ensure proper configuration.
- Created AuthorityNotificationsOptions and its related classes for managing notification settings, including ack tokens, webhooks, and escalation options.
- Developed IssuerDirectoryClient and related models for interacting with the issuer directory service, including caching mechanisms and HTTP client configurations.
- Added support for dependency injection through ServiceCollectionExtensions for the Issuer Directory Client.
- Updated project file to include necessary package references for the new Issuer Directory Client library.

src/Attestor/StellaOps.Attestor.Envelope/EnvelopeSignature.cs

@@ -0,0 +1,48 @@
+using System;
+
+namespace StellaOps.Attestor.Envelope;
+
+/// <summary>
+/// Represents a DSSE envelope signature (detached from payload).
+/// </summary>
+public sealed class EnvelopeSignature
+{
+    private readonly byte[] signature;
+
+    public EnvelopeSignature(string keyId, string algorithmId, ReadOnlySpan<byte> value)
+    {
+        if (string.IsNullOrWhiteSpace(keyId))
+        {
+            throw new ArgumentException("Key identifier is required.", nameof(keyId));
+        }
+
+        if (string.IsNullOrWhiteSpace(algorithmId))
+        {
+            throw new ArgumentException("Algorithm identifier is required.", nameof(algorithmId));
+        }
+
+        if (value.Length == 0)
+        {
+            throw new ArgumentException("Signature bytes must not be empty.", nameof(value));
+        }
+
+        KeyId = keyId;
+        AlgorithmId = algorithmId;
+        signature = value.ToArray();
+    }
+
+    /// <summary>
+    /// Gets the key identifier associated with the signature.
+    /// </summary>
+    public string KeyId { get; }
+
+    /// <summary>
+    /// Gets the signing algorithm identifier.
+    /// </summary>
+    public string AlgorithmId { get; }
+
+    /// <summary>
+    /// Gets the raw signature bytes.
+    /// </summary>
+    public ReadOnlyMemory<byte> Value => signature;
+}