identus-oid4vci: wire types, validation primitives, and the cross-implementation conformance vector suite

Spec is crystallized; component issue per the program rule. Tracking epic: MediaNoxLabs/midnight-identity#20. Depends on #4; uses types from #5/#6 where natural.

## Spec (crystallized)

The OpenID4VCI 1.0 Final profile subset is already co-pinned by two production implementations that share no code: the portal's issuer side and oxid's holder side were made interoperable through a design doc, ADRs, and a fixture exchange, pinned to exact commits on both sides. That pinned profile IS the spec; this crate replaces the pinned-commit dance with a types crate both sides consume.

**Contents**: credential offer, issuer + authorization-server metadata (split), token request/response (pre-authorized code flow), nonce endpoint types, credential request/response including the `proofs.jwt` shape, and the deep-link grammar (`openid-credential-offer://`). Validation primitives with bounded-input discipline (byte/depth caps on every parse - oxid's convention, adopted as default).

**Extension mechanism**: chain-specific response extensions (e.g. the Midnight CBOR phase-1 extension) are modeled as typed extension points owned by their chain family - not in this crate.

**Conformance suite**: oxid's `fixtures/laceid-portal/.../openid4vci-final` vector set (positive + negative, with provenance) transfers in as this crate's test suite - it already encodes the shared contract.

**Policy stays out**: strictness/compatibility posture remains app-side; this crate offers types + validation, not policy.

## Tasks

- [ ] Wire types + serde with bounded-parse validation helpers.
- [ ] Deep-link grammar type; extension-point mechanism with a test double.
- [ ] Import the conformance vectors + provenance as the test suite.
- [ ] Adoption plan documented for both apps (their repoints are tracked in the program epic).

## Acceptance

- Conformance suite green; both app teams sign off that their current wire behavior is expressible.
- Published as `identus-oid4vci` 0.1. Success criterion downstream: oxid deletes its pinned-commit constants and the portal builds its responses from these types.

Start with the OpenID4VCI profile and oxid's fixtures/laceid-portal/.../openid4vci-final vector set, then review dependencies #4, #5, and #6. Implement the types, bounded validation, deep-link and extension mechanisms, and import the positive and negative vectors. Done means the conformance suite is green, both app teams sign off, and identus-oid4vci can be published at 0.1.

Written by the indexing model from the issue text.