examples/sovereign-agent-connector: agentrust_auc accepts boolean GCP iat/exp/instance_id, non-positive/boolean validity_seconds, and non-canonical base64url signatures #379

Summary

1. make_gcp_placement_assertion in examples/sovereign-agent-connector/agentrust_auc/appraisal.py checks isinstance(issued_at, int), isinstance(expires_at, int), and isinstance(instance_id, str | int) without rejecting booleans (isinstance(True, int) is True).
2. make_placement_assertion, make_azure_placement_assertion, and make_gcp_placement_assertion do not validate type(validity_seconds) is int and validity_seconds > 0, and _workload_key_thumbprint accepts uppercase/whitespace hex and non-str workload_key.
3. _unb64 and _verify_signed in examples/sovereign-agent-connector/agentrust_auc/core.py do not enforce canonical unpadded 64-byte base64url signatures or canonical 64-char lowercase hex trusted_key_hex.