A local host admits a named developer as a delivery signer #1063

The local half of solution delivery (codefly-dev/cli#918, PR codefly-dev/cli#954) signs presence and authority with the developer's own OIDC identity through Sigstore keyless, and delivers the same carriers to the local host's delivery routes. The host refuses every one of them. SolutionHostVerificationPolicy.Validate (pkg/infra/solution_host_keyless_verifier.go) requires each signer to name sourceRepositoryUri or buildConfigUri. A person's certificate carries neither.

Change: a signer may be a person:

• exact issuer and exact subjectAlternativeName;
• no prefix and no wildcard;
• no repository fields.

Person signers are admitted only in a policy that declares itself local. A deployed host keeps today's rule: a person signer, or a local policy, is refused at boot. The signer to ownership-domain mapping applies unchanged, and a person is mapped to the domains the local policy names. Document the local profile's trust anchor: trusted root, verification policy and domains.

Done when: a document signed by a listed developer is accepted by a host on the local profile. The same document is refused by a host on a deployed profile, and so is one signed by an unlisted person. Tests prove each case.