feat: cargo xtask identity verify --issuer URL conformance test

Scope

Add cargo xtask identity verify --issuer URL that conformance-checks an OIDC IdP against canopy's contract. Borrowed from CRAIG's Plan E Step 12.

Subcommand fetches <issuer>/.well-known/openid-configuration and verifies the four required endpoints (authorization_endpoint, token_endpoint, jwks_uri, optionally end_session_endpoint)
Fetches JWKS and parses it; confirms ≥1 signing key
Optional client_credentials mint round-trip when test creds provided
Three outcomes: AllPass / Failures / Inconclusive (offline)
Wired into cargo xtask validate as a soft check that SKIPs when CANOPY_IDENTITY_ISSUER env var isn't set; deploy pipeline can pass the env var to make it a hard gate
CHANGELOG entry