mdoc: isolate and evaluate isomdl 0.2.0 for IDR-022

Parent: #151; roadmap: IDR-022/IDR-025; credentials epic: #7.

## Consumer outcome

The mdoc roadmap starts from measured reusable Rust behavior rather than reimplementing ISO 18013-5 or importing a monolithic wallet/reader stack blindly.

## Research disposition

Spike `isomdl = 0.2.0` from `spruceid/isomdl@fcb49d15ad9d54afa028a12183ee7fab1e46a5dc` (Apache-2.0 OR MIT). It provides substantial device/reader, CBOR/COSE, session and state-machine behavior, but the package unconditionally combines library and CLI dependencies, has no declared MSRV and measured about 251 normal packages. Target, X.509, RNG, signing-port and API ownership fit is unproved.

## Prerequisites

The implementer must have authorized access to applicable ISO text/test material. Public summaries or upstream code do not substitute for normative conformance.

## Before implementation

Create a spike OpenSpec and full `research.md`, pin ISO editions/profile scope and the upstream revision, then pass `scripts/factory research-ready `.

## In scope

- Map issuer-signed data, device engagement/session transcript, selective disclosure, device auth/MAC/signature and verifier results to Identus format-neutral states/ports.
- Identify the smallest reusable library seam and dependencies that can be feature-gated or adapted.
- Measure MSRV, host/WASM/mobile compile/link behavior, cone, unsafe/native code, test vectors and API stability.
- Compare use-as-is, contribute modularization upstream, extract with provenance, oracle-only and local implementation.

## Non-scope

No production dependency, certification claim, platform NFC/BLE/QR UI, custody, concrete trust store, CLI, server, downstream edit or release.

## Acceptance evidence

- Licensed normative scope and source provenance recorded.
- Consumer-shaped holder and verifier proof with state/error/port mapping.
- Complete cone/target/security/maintenance report and explicit disposition.
- Any production adoption receives a separate bounded issue.

Create the spike OpenSpec and full research.md first, pinning the ISO editions/profile scope and upstream revision. Run scripts/factory research-ready before implementation. Evaluate the listed isomdl seams and targets, then provide licensed provenance, holder/verifier state/error/port mapping, complete cone/target/security/maintenance evidence, and an explicit disposition.

Written by the indexing model from the issue text.