feat: enforce restricted trust-domain directory decisions

[RobLe3]

Summary

Adds the Python SDK's fail-closed restricted-directory operation boundary from the merged Rust reference contract.

• resolves membership through environment or owner-only file references
• binds membership and subject headers to protected discovery, dispatch-ticket, and consumer-token operations
• requires exact, current, operation-specific directory decisions
• refuses redirects and legacy/public fallback while restricted mode is configured
• keeps candidate eligibility process-local and does not claim peer-gossip or CIP support
• leaves public behavior unchanged when the context is absent

Evidence

• .venv/bin/python -m pytest -q: 1182 passed, 2 skipped
• .venv/bin/ruff check src tests/test_restricted_directory.py: passed
• targeted mypy: passed

Closes #103 after review and required CI evidence. Root black-box closure remains owned by RobLe3/iicp.network#921.