Add pre-call ASM selection to the receipt composition test

[YE-YI7]

What this adds

This extends the existing ScopeBlind + APS composition test with a separate pre-call ASM Selection Receipt:

ASM Selection Receipt (why this route; unsigned v0.1)
        ↓ digest reference
ScopeBlind policy receipt (was the call allowed; signed)
        ↓
ScopeBlind execution receipt (what executed; signed)

The three artifacts do not merge authority. ASM explains the fixture choice and pins the two consulted manifests. ScopeBlind and APS remain authoritative for their own signed policy/execution events.

Concrete changes

• add two scenario-local ASM manifests, both schema-valid and explicitly not live provider-price claims
• add one deterministic Selection Receipt that selects the existing $0.50 route over a $0.80 fixture alternative
• include only the Selection Receipt identity/digest under extensions.asm in the two ScopeBlind-signed receipts
• verify both manifest digests, the Selection Receipt digest, both signed references, and the shared action anchor in verify-all.sh
• document the unsigned v0.1 limitation and event-ownership boundary

While exercising the current fixture, I found that the ScopeBlind generator minted a different action_ref from the checked-in APS composition receipts. This patch reuses the existing APS anchor byte-for-byte and makes verify-all.sh fail if they diverge again.

Verification performed

Selection Receipt digest: sha256:4c4a9ebb847ff07721862a0f7e214c64606704b1ac31cac5cd6451488e6632e0
2 manifest digests: MATCH
2 signed Selection Receipt references: MATCH
ScopeBlind / APS action_ref: MATCH
8 signed receipts: VALID with @veritasacta/verify@0.2.5

Both manifests also pass the public asm-protocol==0.5.2 release (asm-lint) with selection_readiness=ready.

Review questions

1. Is a separate extensions.asm reference acceptable here, or would ScopeBlind prefer a reverse-DNS key or a ScopeBlind-owned reference field?
2. Is the existing APS action-ref.txt the intended canonical anchor for this composition fixture? This PR assumes yes and stops generating a competing one.

The repository-native composition verifier above is self-contained and does not depend on the package release. The separately tested lint command is now public as asm-protocol==0.5.2; this PR intentionally does not add that package to ScopeBlind CI.

This PR does not claim ScopeBlind adoption, partnership, endorsement, or shared governance. If the extra pre-call artifact makes this example less clear, closing the PR is a valid outcome.

[YE-YI7]

One factual follow-up: asm-protocol==0.5.2 is now public on PyPI, and both scenario manifests reproduce selection_readiness=ready. The checked-in verify-all.sh remains self-contained and does not install ASM.

The two review questions remain intentionally narrow: whether extensions.asm is an acceptable reference location, and whether the existing APS action-ref.txt is the canonical shared anchor. If the extra pre-call artifact makes the example less clear, closing is a valid outcome. I will not ping again.