Add cross-operator delegation offline example and verify-dag CLI command

[imran-siddique]

Bridges part of the offline gap tracked in #43: adds a ca2a verify-dag CLI command and an honest, self-contained offline example.

What this adds

ca2a verify-dag CLI command (src/ca2a_runtime/cli.py) — mirrors verify-chain: same argparse style, same fail-closed non-zero exit on any violation, ASCII/UTF-8-safe JSON output. Loads a provenance DAG (--dag) and runs provenance.verify_dag; with an optional --chain it additionally runs provenance.cross_check_chain to bind the DAG to the signed delegation chain.

examples/cross-operator-delegation/ — productizes experiments/claim6-cross-operator-attestation/run.py into example shape (README + config + Cedar policy + demo.py), following the examples/minimal conventions. Story: a Parent in trust domain A delegates a scoped task to a Child in domain B; the operators hold independent keys and mutually attest; each attestation binds that side's channel key; the task is sealed to the Child's attested key; the Child enforces delegated scope ∩ local policy ({task:read,task:write} ∩ {task:read,task:audit} = {task:read}); a silently swapped binary is rejected on measurement mismatch; per-hop provenance records form a hash-linked DAG. The demo ends by re-verifying the committed chain.json / dag.json through ca2a verify-chain and ca2a verify-dag.

Honest labeling (per #43 and LIMITATIONS.md)

• Real and hardware-independent: delegation-chain verification, scope ∩ policy intersection, and provenance-DAG verification. These are what the two CLI commands re-check.
• Software-asserted: the attestation step uses synthetic SEV-SNP vectors — no real quote, no TEE hardware — exactly as the SEV-SNP verifier's tests do. Real hardware end to end remains pending.
• Config is software-only / advisory; cA2A has no transport yet.

Tested (venv with ca2a-runtime installed editable, PYTHONUTF8=1)

• python -m ca2a_runtime.cli --help lists verify-dag.
• python examples/cross-operator-delegation/demo.py exits 0 (12/12 checks OK).
• ca2a validate-config, ca2a verify-chain, and ca2a verify-dag (with and without --chain) on the committed artifacts all exit 0.
• ruff check and mypy pass on the changed files.

Advances the first two boxes under "Deliverables tracked here" in #43. Does not touch the runtime/transport work (Tier 2/3).

🤖 Generated with Claude Code