fix(didresolver): wrap resolved verifier as requested DID

[frrist]

Summary

ucantone/ucan/token/token.go VerifySignature performs an equality check between the token's issuer DID and the verifier's DID before examining signature bytes:

if tok.Issuer() != verifier.DID() {
    return false, nil
}

When a token issued by did:web:foo is verified using a verifier returned by HTTPResolver or MapResolver, the resolver was previously handing back an unwrapped did:key: verifier. The equality check failed, VerifySignature returned false, and the validator surfaced an InvalidSignature error — even though the signature bytes were perfectly valid.

This PR wraps the resolved did:key: verifier so its DID() returns the originally-requested DID (the did:web: the caller asked for). did:key: inputs to MapResolver remain unwrapped, since they already self-describe.

Origin

The bug has been present since the resolvers were ported in #17. That PR's description called it out as a known follow-up:

It has a soft dependency on fil-forge/ucantone#7 in that you'll need to wrap the resolvers with something to make them look like what is required by ucantone right now.

This PR is that follow-up. The wrapping happens at the resolver boundary (rather than inside ucantone), so it lands here in libforge.

How this was found

While debugging a UCAN admin invocation in smelt's local dev stack: sprue's provider register self-invocation kept failing InvalidSignature despite client and server loading the same key file and the published did.json publishing the matching pub key. Tracing through ucantone's validator showed the early-return on the DID mismatch, and the resolvers were the only realistic spot where that mismatch could be introduced.

Test plan

• go test ./didresolver/... passes locally (updated assertions reflect new behavior — resolved verifier announces requested DID; underlying did:key reachable via Unwrap())
• End-to-end: sprue admin invocation succeeds after this change (verified against a local smelt stack)
• Reviewer to spot-check that no callers depend on resolver.Resolve(...).DID() returning the underlying did:key: — call sites in sprue/indexing-service/delegator use the verifier only to verify signatures, so the change is safe for them; other consumers should be audited.

🤖 Generated with Claude Code

[alanshaw]

👏 OMG good debugging