Verify AAO-hosted publisher origin

Trigger origin verification for an AAO-hosted publisher: fetches the publisher's own /.well-known/adagents.json and checks for an authoritative_location field pointing at the AAO-hosted URL. On success, promotes agent_publisher_authorizations rows from source='aao_hosted' to source='adagents_json' for the manifest's authorized agents — buyers reading the registry then see them as origin-attested.

Bind-on-verify: when the pointer carries an adcp_claim token (see the claim endpoint), a successful verification binds the domain to that claim's organization and returns bound_org_id. Binding is driven by which token the origin pointer carries, never by who triggers verification, so any authenticated caller may trigger it and a squatter cannot bind a domain they don't control. An existing verified owner is never overwritten.

Failure classification:

• not_found: publisher origin returned 404 (permanent — demotes if previously verified).
• invalid_json / no_authoritative_location / authoritative_location_mismatch: publisher origin returned a parseable response that doesn't satisfy the spec stub pattern (permanent — demotes).
• unresolvable: DNS NXDOMAIN, private IP, or non-http scheme (permanent — demotes).
• transient: 5xx / 429 / 3xx / network timeout (leaves persisted state alone, stamps origin_last_checked_at).