docs(verifier): add edge verification recipe

[jithinraj]

Summary

Adds a generic edge verification recipe for PEAC records, with provider-specific references kept secondary. The recipe restates existing verifier limits and resource-bound verification behavior from docs/specs/RESOURCE-LIMITS.md.

Scope

• New docs/SOLUTIONS/verify-at-the-edge.md (generic edge verification recipe; H1 # Verify PEAC records at the edge; full "PEAC does NOT" boundary block; provider-specific Cloudflare reference confined to one row in a stability-class table).
• New tests/tooling/edge-verifier-doc-truth.test.ts (24 doc-truth assertions across 7 describe blocks; forbidden-prose patterns assembled non-contiguously so the test source stays scan-clean).
• docs/SOLUTIONS/README.md index updated with a recipe row.

Out of scope (no behavior change)

• No schema changes.
• No registry changes.
• No type URI changes.
• No conformance changes.
• No API / CLI / package-publication / wire surface changes.
• No live-network test.
• No hosted-verifier product language.
• No release-state transition; docs/releases/facts.json untouched.

Posture

• Generic edge recipe first; provider-specific references second. The "Minimal deployment pattern" section teaches the bounded verification shape generically. Cloudflare Worker and Docker Compose appear only inside the "Provider-specific references" table as one-line stability-class rows.
• Cites repo-local source-truth Body cap 256 KiB, JWKS fetch timeout 5,000 ms, JWKS keys cap 100, TTL bounds 60..86,400 s default 3,600 s, Node resolver outbound 30,000 ms default, redirect chain cap 5 — all restated from docs/specs/RESOURCE-LIMITS.md. Verify report shape and error shape link to packages/schema/openapi/verify.yaml and RFC 9457 Problem Details.
• PEAC does NOT block covers six bounded actions: host the governed runtime, authorize the action, route agent traffic, enforce runtime policy, operate payment rails, or become an edge platform. The boundary is stated once in the recipe and verified by the doc-truth test.

Drift sentinels (unchanged from post-PR-1)

• build_targets = 107
• published_packages = 36
• conformance_requirement_ids = 290
• conformance_sections = 32
• extension_groups = 19
• receipt_types = 61
• API contract allKeys = 27

Validation

• pnpm exec vitest run tests/tooling/edge-verifier-doc-truth.test.ts — 24/24 pass.
• node reference/scripts/verify-local-doc-truth.mjs — exit 0; 26 files clean.
• node reference/scripts/verify-final-hygiene.mjs — 7/7 PASS.