Add shared Verified Access protocol for KTP and sa-yo

[akskos]

Summary

• Add @digabi/verified-access with shared version-1 request/response schemas, inferred types and the payload length limit.
• Keep KTP session status, sa-yo storage/provider interfaces and Google implementation details in their owning services.
• Add five protocol tests and include the package in the publishing workflow.

Requested in review of digabi/sa-yo#1923; consumers are that PR and digabi/digabi2#2339.

Validation

Package build, lint and five tests pass. Structured Codex autoreview completed without actionable findings. The transport schema intentionally bounds strings; canonical base64/protobuf validation remains in sa-yo.

Prerelease

Published @digabi/verified-access@0.1.0-feature-verified-access-protocol.0 to npm with the feature-verified-access-protocol tag. The initial publication used the maintainer's authenticated npm CLI because the new package could not yet use OIDC. Trusted publishing was successfully configured for digabi/node-packages / publish.yml for future releases.

The consumer PRs pin this prerelease while this package PR is reviewed. No service deployment was performed.

Prepared and updated by Codex.