fix(dwn): require authorized role issuers

[LiranCohen]

Summary

• reject protocol definitions that let anyone create or squash a $role assignment
• keep trusted owner, delegate/grant, contextual, and existing-role issuance paths intact
• migrate unsafe test fixtures to tenant-issued roles or explicit grants and document the new protocol-configuration rule

Closes #1477.

Test plan

• bun test tests/interfaces/protocols-configure.spec.ts
• targeted delegated-role issuance and non-current audience-key handler tests
• targeted affected query/count/subscribe, protocol-history, delivery, and agent encryption tests
• bun run lint
• bun run --filter @enbox/dwn-sdk-js build
• bun run --filter @enbox/agent build

Migration

Unsafe definitions already installed in a DWN are not rewritten. Retire the old protocol URI, install a corrected definition under a new URI, migrate only authorized role assignments, and stop relying on roles issued under the unsafe definition.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud