refactor(vta): adopt vta-sdk connect_auto, delete duplicated transport branch (R22)

[stormer78]

Problem

The DIDComm-vs-REST VTA connect branch — transport selection, the
rest_fallback derivation, and the empty-vta_url rule — was hand-rolled
identically in two places:

• did-git-sign/src/vta.rs::authenticate
• openvtc-core/src/config/mod.rs::build_runtime_vta_client

That logic is SDK-level knowledge. The upstream issue
(OpenVTC/verifiable-trust-infrastructure#366) proposed VtaClient::connect_auto,
which shipped in vta-sdk 0.11 as connect_auto(AutoConnect) -> ConnectedVta.

Fix

• Bump vta-sdk 0.10 → 0.11.
• build_runtime_vta_client delegates to connect_auto. A small
  map_connect_error preserves the R18 error taxonomy:
  VtaError::Validation → OpenVTCError::Config (bad on-disk config, e.g.
  empty REST url), VtaError::Auth → OpenVTCError::Auth, everything else
  (network / DIDComm session open) → OpenVTCError::Vta.
• did-git-sign keeps its application-level policy — caller-side REST
  token cache + transient-failure retry — but routes the actual connect
  through connect_auto via a new connect_with_retry. The cached-token
  short-circuit is now explicitly gated on the REST transport
  (mediator_did.is_none()), matching the prior implicit gating; the
  empty-access-token guard is preserved on the REST path.

Behavior notes

• Identical for DIDComm-capable and REST-only VTAs.
• One intentional, benign change: retry now covers the DIDComm path too (it
  previously wrapped only the REST challenge-response). A transient mediator
  hiccup is worth a second attempt on either transport; bounded by
  MAX_AUTH_RETRIES = 2.

Tests / gate

• cargo fmt --all, cargo clippy --workspace --all-targets -- -D warnings,
  cargo test --workspace — all green.
• Existing validate_credentials unit tests in did-git-sign unchanged and
  passing.
• Reviewed the diff against the published connect_auto semantics for
  error-mapping fidelity, cache gating, and the empty-token guard — no
  correctness regressions.

Follow-up (pre-existing, out of scope)

did-git-sign::authenticate returns the VtaClient to callers that never call
shutdown(), leaking the DIDComm session per git commit. This is identical
in the deleted code (not a regression). Worth a separate fix giving
did-git-sign a with_didcomm-style scoped shutdown, mirroring
openvtc-core::with_runtime_vta_client.

🤖 Generated with Claude Code