fix(provenance): require textual identity locators

[altrudev]

Closes #285.

What

spec/server-provenance-v1.md defines identity.artifact.package as a Package URL and identity.endpoint.url as a URL. The shared producer/consumer structural check previously used truthiness only, so truthy non-string JSON values could satisfy both locator-presence checks.

This change adds one small non-empty-string boundary and applies it to both locator fields from _check_structure(), which is shared by build_record() and verify_record().

Regression coverage

For both producer and verifier paths, the tests refuse:

• true;
• integer 1;
• array [1];
• object {\"x\": 1}.

Positive controls keep ordinary textual Package URL and HTTPS locator values working.

Scope

This is intentionally only the primitive/type boundary. It does not add full Package URL parsing or broader URL syntax policy.

AI-assistance disclosure: ChatGPT assisted with source triage, adversarial-case design, implementation drafting, and diff review. altrudev reviewed the bounded claim and remains responsible for the contribution.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[lywinged]

Approved on c943434 over fc38496. Reproduced on main: _check_structure() tests artifact.package and endpoint.url by truthiness, so true, 1, [1] and {"x": 1} satisfy the presence check. On this head each is refused through both build_record() and verify_record() and textual locators pass; the PR's own test file has 16 of 17 cases failing against main and none here. Suite 1,184 passed, 1 skipped; ruff, mypy and the dash check clean.

Tool-assisted: the runs and this write-up.