Bind score-average trust evidence to subjects

Description

The pitch.

## Problem

`ScoreAverageTrust` trusted two caller-controlled references to the subject independently. A malicious caller could report evidence about `victim` while mutating `innocent`, and an attestation could pair an arbitrary `agent` argument with a claim about someone else. Unknown evidence kinds were also recorded as neutral samples, allowing meaningless reports to raise confidence to 1.0. Finally, identity-signed attestations reported `issuer=system` even when the signature named the real signer.

## Change

- Reject reports when `agent != evidence.subject` before state mutation.
- Reject unsupported evidence kinds instead of counting them as neutral samples.
- Reject attestations when `agent != claim.subject`.
- Bind `Attestation.issuer` to `Signature.signer` for both system and identity-backed signatures.
- Document the fail-closed behavior in the public method docstrings.

## Adversarial coverage

Four regression tests prove that:

1. evidence about one subject cannot mutate another subject;
2. unknown kinds cannot inflate sample count or confidence;
3. a mismatched claim cannot be attested; and
4. an identity-backed attestation has a verifiable issuer/signer binding.

## Verification

`make ci-local` passes all five gates:

- `uv sync`
- `ruff check`
- `ruff format --check`
- `pyright` (0 errors)
- `pytest` (984 passed, 1 skipped, 1 deselected)