fix(notary): validate claim response formats

[jeremi]

What changed

• default an omitted claim formats list to claim-result JSON
• reject explicit empty lists, unsupported formats, and lists that omit claim-result JSON during configuration load
• add focused validation coverage and update the doctor fixture
• align the operator reference, changelog, known limitations, and RS-DM-CLAIM specification with shipped validation

Why

An omitted or empty formats list previously deserialized to an empty vector. The configuration could load successfully, but evaluation would later reject even the default claim-result JSON response because the claim did not advertise it. Unknown or incomplete format declarations were likewise deferred until runtime.

This makes the configuration boundary fail early while preserving the documented default for omitted fields.

Impact

Existing claims that omit formats now work with claim-result JSON by default. Explicit lists must include application/vnd.registry-notary.claim-result+json and may contain only the implemented claim-result JSON, CCCEV JSON-LD, and SD-JWT VC media types.

Configurations with empty, incomplete, or unknown lists will fail to load until corrected.

Validation

• cargo test --locked -p registry-notary-core
• cargo test --locked -p registry-notary --test doctor_cli
• cargo test --locked -p registry-notary-server
• cargo clippy -p registry-notary-core -p registry-notary --all-targets -- -D warnings
• products/notary/just ci-preflight
• products/notary/just openapi-check
• docs tests, content/Markdown/style checks, tutorial dry run, current and archived builds, SEO, and built-link checks

[jeremi]

Superseded by current-base replacement PR #405, which preserves the accepted omitted/empty contract, separates registry evaluation formats from SD-JWT credential output, retains registry-backed-only issuance guards, and has passed independent current-base review. Closing this stale pre-v0.10 draft in favor of #405.