fix(adapters): default PolicyEvidence mode to declared

[solloek369-arch]

What changes

Implements the integrations portion of agentrust-io/trace-spec#416.

• PolicyEvidence(bundle=...) defaults an omitted enforcement_mode to declared instead of enforce.
• Explicit enforce, advisory, silent, and declared pass through unchanged; unknown modes remain rejected.
• The README makes the emitted default and migration for existing callers explicit.
• This package's agentrust-trace dependency floor changes from >=0.7.0 to >=0.9.0.

The repository-wide compatibility.yaml floor is unchanged; this PR changes only this package's runtime dependency to the first TRACE release that can represent its new default.

An omitted evidence-constructor argument must not infer that policy enforcement occurred. Callers with an independently established enforcement context pass the actual mode explicitly. Runtime enforcement defaults and behavior are unchanged.

Compatibility

This changes the emitted evidence for callers that previously omitted the mode. Callers that established enforcement can continue to supply enforcement_mode="enforce" explicitly.

TRACE 0.9.0 introduced declared; the published wheels were checked: 0.8.0 admits only enforce | advisory | silent, while 0.9.0 also admits declared. At 0.9.0, three pre-existing OpenShell tests fail because its JSON Schema requires transparency; 0.10.0 no longer requires that field. This PR neither causes nor fixes those failures. The hash-locked CI dependency environment uses 0.10.0, against which the local package suite passes. The new dependency floor is therefore not a claim that the complete package suite passes at 0.9.0.

Validation

Local validation on macOS with Python 3.12.14, published TRACE packages, and a wheel built from this patch. These results are not a CI run.

• TRACE 0.10.0 from requirements/adapters.txt's hash-locked environment: tests/test_builder.py 31 passed; package tests 110 passed.
• TRACE 0.9.0: tests/test_builder.py 31 passed. In the earlier unchanged-base reproduction at f6e8c8b, the package suite was 102 passed, 3 failed. The candidate run produced 107 passed, 3 failed; the same three OpenShell test identities and primary 'transparency' is a required property messages were reproduced. The baseline was not rerun in this GO 2A validation.
• Both environments have zero skipped tests and pass pip check.
• Two targeted mutation controls were run in separate local source copies: restoring the enforce default fails the omission regression, and removing declared from MODES fails the explicit-declared regression. Each pytest process exits 1 for the intended failure while the invalid-mode control still passes. The unmodified builder suite passes again in both environments.
• Local distribution inspection using requirements/release.txt (build 1.6.1, twine 7.0.0): sdist and wheel built successfully, and twine check passed for both. The wheel built from the sdist is byte-identical to the wheel used for the package tests above. This is not a run of the complete release workflow.

Corresponding trace-spec PR: agentrust-io/trace-spec#417.

Follows agentrust-io/trace-spec#416.

[imran-siddique]

Thanks Loek. Same collision as trace-spec#417: spec section 4.3 says declared "MUST NOT be a default", so PolicyEvidence cannot pick it for the caller either. trace-spec#419 settled the adapters by requiring enforcement_mode with no default, and #227 does the same for the four framework adapters here. Could this PR follow that shape, a required argument instead of a new default? Edits by maintainers are on here, so I can push it if you prefer.

[solloek369-arch]

Yes please Imran, push the same required-argument shape here.
Sorry for the extra work!