feat(trust): implement 2-pass SybilResistantTrust plugin

Description

The pitch.

## Overview
This PR implements a robust, security-hardened **2-Pass Eigen-weighted Trust & Reputation plugin** (`sybil_resistant`) under the Trust layer, along with a dedicated test scenario and active decision-gating to prevent Sybil attacks, collusion rings, and ballot-stuffing.
The naive `score_average` baseline is easily manipulated by Sybil identities circle-vouching each other. This plugin introduces an algorithmic defense that isolates and penalizes malicious clusters in P2P agent networks.
---
## Core Features & Mechanisms
### 1. Algorithmic Trust Model (`sybil_resistant.py`)
- **Pass 1 (Baseline)**: Computes a baseline reputation score for all reporters based on order-sequenced, burst-decayed opinions.
- **Pass 2 (Eigen-weighted)**: Computes the final reputation score of a subject by weighting each reporter's opinion by their Pass 1 reputation. Trusted reporters have a high influence, while untrusted/cheating reporters have their weight restricted.
- **Collusion Ring Penalty**: A directed-graph algorithm detects mutual-boosting pairs ($A \rightarrow B$ and $B \rightarrow A$ with no negative reports). Ring members are penalized with a $0.1$ multiplier on their reporting weights.
- **Burst Damping**: Uses an exponentially decayed step size $\alpha$ to damp high-frequency positive report floods from a single identity, capping maximum score inflation.
- **Negative Feedback Dominance**: Negative reports are weighted 3.0x more heavily than positive reports to ensure one cheat immediately contains and isolates an attacker.
### 2. Active Decision Gating (`sybil_reputation.py`)
To prevent a "vacuous" simulation trace where agents ignore trust:
- `HonestTrader` query `trust.score()` before accepting trade requests or delivering payloads.
- If an agent's reputation drops below `0.45`, honest traders reject the trade, send a `refuse:` message, and select a different peer.
- `SybilObserver` dynamically calls `trust.report()` on trade outcomes, ensuring reputation scores update in real-time.
---
## Validation Differential & Tests
We updated the validators in `validators.py` and implemented a dedicated integration test scenario `test_sybil_scenario.py` to ensure the validation suite successfully flips:
- `validate_sybil_flood_resistance`: FAILS if cheats $\ge 12$ in the trace.
- `validate_sybil_collusion_ring`: FAILS if there are no `refuse:` messages in the trace.
### Verification Results
- Under `score_average` (naive baseline), the collusion ring succeeds, cheats are high, and no refusals occur $\rightarrow$ **FAIL** (2/2 scenario validators fail).
- Under `sybil_resistant` (this plugin), the collusion ring is neutralized, cheats are mitigated ($< 12$), and refusals are triggered $\rightarrow$ **PASS** (all validators pass).


### How to Run Tests
The codebase is clean of type errors and all tests pass:
```bash
# Run specific scenario tests
uv run pytest packages/nest-plugins-reference/tests/test_sybil_scenario.py -v
# Run full workspace check
uv run pyright
uv run pytest -v