Feat/issue 55 operator identity

[rosspeili]

Description

Optional verified operator identity (#55) — lite ID stays the default; enterprises can attach a verified human/service principal to session receipts.

• aura/identity/ — manual, mock, OIDC, and Auth0 adapters; bind at session open; identity.bound on spine
• ids.operator on every event’s agent_ids trailer (SIEM parity); summary + OTel redact PII by default
• SDK — session(identity_adapter=...), operator=, profile types (role: identity); approve() defaults principal to operator
• CLI — aura identity show; [identity] extra for JWT verification
• Example 09 + integrations/identity/README.md (BYO adapter pattern)

Fixes #55

Type

• Core framework — session, spine, constraints, identity, audit report
• CLI
• Integration — exporters (OTel operator attrs, redaction)
• Documentation
• Examples
• Packaging / CI — pyproject.toml [identity] extra

Checklist

• Linked issue (Fixes #55)
• pytest passes (111/111)
• black aura tests — no diff
• flake8 aura tests — clean
• CHANGELOG.md updated when user-visible behavior changes

Test plan

• tests/test_identity.py — no-ID unchanged, adapters, redaction, OTel, approve principal, profile types
• tests/test_session_invariants.py — no regression with [Core]: Harden session lifecycle and export invariants #15 lifecycle
• tests/test_cli.py::test_cli_identity_show
• tests/test_examples_smoke.py — example 09 folder
• Full suite + Skillware integration paths green
• Docs ripple: trust-paths, comparison, INDEX, TESTING, outputs, schema, README