[AI assisted] Plan G integration: anchor block on V2 register, persist + surface

[scourtney-godaddy]

Wires the AnchorResolver into the V2 register handler and the storage layer. A registration now carries an optional anchor block; the V2 list endpoint surfaces anchorType and anchorResolvedId per row. Plan F's base-only path is the carrier for any non-FQDN anchor.

---

The second of three Plan G PRs. The previous PR added the
AnchorResolver abstraction and the resolver implementations
(FQDN, did:web, LEI). This PR plumbs the resulting IdentityClaim
through the registration service, persists it on the registration
row, and surfaces it on V2 list and detail responses. The V2
register endpoint accepts an optional anchor block on the wire.

Domain layer:

• AgentRegistration gains an AnchorClaim *IdentityClaim
  field. Nil for legacy registrations where the identity is
  implicit in AgentHost; populated when the V2 register call
  carried an explicit anchor block.
• NewRegistration accepts the claim as a new parameter.
  Non-FQDN claims (DID, LEI) carrying a non-zero ANSName or
  non-nil identity CSR fail with
  NON_FQDN_REQUIRES_BASE_ONLY. Until ANS-2 admits non-FQDN
  URI SANs, DID and LEI registrations must take the base-only
  path.

Service layer:

• RegisterRequest gains an AnchorClaim field; the service
  passes it through to NewRegistration verbatim.
• The base-only uniqueness check is now scoped by
  (host, anchor_type) rather than host alone (this fix
  ships in the third Plan G PR; this PR carries the field but
  not the scoping change).

Storage layer:

• Migration 009 adds anchor_type and anchor_resolved_id
  (both nullable) to agent_registrations. Pre-Plan-G rows
  load with both empty.
• Save writes the columns through a new anchorClaimColumns
  helper. toDomain rehydrates AnchorClaim from the columns,
  leaving PublicKeyJWK empty (verifiers re-resolve through
  the AnchorResolver to honor each profile's freshness budget,
  rather than trusting a stored value).
• A round-trip test pins the FQDN/DID/LEI/no-claim cases.

Handler layer:

• registrationRequest gains an optional anchor block:
  { "anchorType": "fqdn"|"did"|"lei", "input": "..." }. Empty
  block omitted from the request signals the legacy
  FQDN-implicit path.
• resolveAnchorClaim validates the wire shape: anchorType
  must be one of the three values; input must be non-empty;
  the FQDN profile additionally requires input to match
  agentHost case-insensitively (ANCHOR_INPUT_AGENT_HOST_MISMATCH).
• The V2 list (listItem) and detail (agentDetails) DTOs
  gain anchorType and anchorResolvedId (both omitempty so
  legacy registrations emit nothing). A shared anchorFields
  helper reads from reg.AnchorClaim, returning empty strings
  for nil claims.

The handler-side IdentityClaim carries an empty PublicKeyJWK:
full resolver dispatch (fetching the DID document, calling the
GLEIF API) lands in a follow-up PR. The current shape stores the
anchor type so V2 list and detail responses can surface it,
which is enough for client-side filtering and for downstream
tooling to differentiate FQDN, DID, and LEI registrations.

Stacks on #15 (Plan G core) → #14 (Plan F) → #13 → #12. Merge
order: #12 → #13 → #14 → #15 → this.

Test plan

• make check (gofmt + golangci-lint + 90% coverage gate)
• Domain tests: FQDN claim attaches; DID + versioned rejected; DID + base-only accepted; LEI + base-only accepted
• Storage round-trip across FQDN/DID/LEI/no-claim cases
• Handler tests: omitted block returns nil claim; missing/unknown type errors; FQDN agentHost-mismatch rejection; DID and LEI input pass through
• anchorFields helper for nil/empty/populated claims
• Reviewer confirms migration 009 applies cleanly

🤖 Generated with Claude Code