fix(anchors): verify_rfc3161 keeps the never-raise rule it prescribes to others

[b7n0de]

The contradiction this closes

register_anchor_type tells third-party authors that a verifier "MUST be fail-closed … never raise for an ordinary bad proof". This first-party implementation did not hold its own rule. frozen and rp_trust are consumed with .get(...), so a non-dict raised a raw AttributeError out of a surface whose job is to return a verdict.

The self-gate run recorded it as F3 on 2026-07-31. Re-measured against main today, sixteen days later:

rp_trust=123 -> AttributeError: 'int' object has no attribute 'get'
frozen=123   -> AttributeError: 'int' object has no attribute 'get'

Why it survived sixteen days, which is the more useful half

Two axes of the never-raise family property were blind to it at the same time:

Axis	Why it missed this	Status
module	anchors_rfc3161 was not in _MODULES; the property never entered the module	closed by the coverage guard in #141
argument	the property fuzzes only the primary parameter, and both affected arguments are keyword-only — even inside the population it does not reach them	still open (the self-gate's F2)

So this PR adds a test that covers this one surface directly, rather than relying on a sweep that provably does not reach it. Relying on it would be closing the instance while believing the class was closed.

The floor, not a wider except

Same reasoning as the evalcard / prereg floors (L1-01). An except AttributeError would close this one shape, let the next type-confusion sibling through, and swallow a genuine internal AttributeError on top. BundleFormatError is in the family's accepted set, so the surface still decides instead of crashing.

A measurement precondition worth stating

Without proofbundle[anchors] installed, verify_rfc3161 returns at its optional-import guard before these lines. A probe run that way reads green for a reason that has nothing to do with the defence it names — the class this repository's own fixture manifest calls vacuous_seam_passes_for_a_reason_other_than_the_defence_it_names. The new tests therefore skip honestly when the extra is absent, instead of passing vacuously. That distinction cost a wrong reading earlier today before it was caught.

Bidirectional evidence

	With the floor	Floor temporarily removed
new tests	5 green	FAILED (failures=1, errors=8)
failure message	—	frozen=123 still raises a raw AttributeError: 'int' object has no attribute 'get'

The failure reproduces the original finding verbatim, so the green is the fix rather than a coincidence. Two of the five tests exist for the other direction: the documented rp_trust=None default and a valid mapping must still reach a verdict, so the floor cannot have broken the surface it protects.

Full suite Ran 2035 tests, OK (skipped=10) · ruff clean · mypy: no issues in 63 source files.

Honest severity, unchanged from the finding

This surface is not exported at package level, and verify_anchor wraps every verifier in except Exception, so nothing leaked over the public path. The contradiction was the point — the project's own implementation not keeping the rule it prescribes to others.

Not part of the 3.8.0 release candidate (#140), whose delta is a single file. This targets main on its own.