feat(trace): TRACE A2A delegation-link profile field + validation

[imran-siddique]

Add the optional delegation-link block (parent_record_hash + delegation credential id) to the TRACE record in trace-spec, plus validation. On the trace-spec roadmap as the A2A profile; A2A is now stable at v1.x so the blocker is cleared. See docs/spec/trace-a2a-profile.md.

[carloshvp]

Strong +1 on making the delegation link explicit in TRACE rather than leaving it as out-of-band context.

One validation angle that seems worth locking down early: this should behave like offline-verifiable action provenance. Similar to the action_receipts work in agentrust-io/trace-spec#66 and the embodied evidence profile in agentrust-io/cmcp#339, the verifier should prove authorization continuity and record binding, without implying that the delegated action physically succeeded or that local policy allowed it.

Suggested conformance cases once the field shape settles:

• valid root -> child TRACE record chain with parent_record_hash and delegation credential id
• missing parent record for a non-root delegation link
• parent record present but hash mismatch after canonicalization
• delegation credential id present but not resolvable in the verifier's trusted material
• delegation credential resolves, but is not bound to the expected delegator/delegatee/session/scope
• attempted scope widening vs valid attenuation
• valid negative outcome, such as delegation rejected or policy denied, which should remain valid provenance rather than a verifier failure

I would also keep verifier errors distinct from policy/controller outcomes: malformed or unverifiable delegation-link data should fail provenance validation, while a valid chain that ends in deny/reject should still be useful evidence.

Happy to help with fixture-style examples or tests here, especially if we want them to line up with the embodied action receipt fixtures in agentrust-io/examples#36.