v0.3.0-alpha.1 (P1.2): DNS TXT cross-verification at _agentpin.{domain} (Rust)

[jaschadub]

Summary

Adds an OPTIONAL second-channel verification mechanism mirroring SchemaPin v1.4-alpha.1's `_schemapin.{domain}` record exactly. The wire format is the same parser shape with the version tag changed; AgentPin spec § 4.8.3 had already reserved this slot in v0.1, this PR ships the implementation.

Independent of PR #2 (v0.3.0 A2A AgentCard types) — both ship in alpha.1; either can land first.

Wire format

```
_agentpin.example.com. 3600 IN TXT "v=agentpin1; kid=acme-2026-04; fp=sha256:a1b2c3..."
```

Field	Required	Notes
`v`	yes	Must be `agentpin1` (cleanly rejects `v=schemapin1` records).
`fp`	yes	`sha256:` JWK thumbprint.
`kid`	no	Optional key id; when present, the matching JWK MUST also carry the same `kid`.

Whitespace around `;` and `=` tolerated. Unknown fields ignored for forward compatibility.

API additions

Item	Availability
`dns::DnsTxtRecord`	always
`dns::parse_txt_record(value)`	always
`dns::verify_dns_match(discovery, txt)`	always
`dns::txt_record_name(domain)`	always
`dns::fetch_dns_txt(domain)`	behind `dns` Cargo feature (hickory-resolver)

Multi-key match semantics: AgentPin discovery docs may carry several keys for rotation. A published TXT record need only match one of them. When the TXT carries an explicit `kid`, the matching key MUST also carry the same `kid` (defends against the vanishingly-unlikely case of two keys sharing a SHA-256 fingerprint).

Cargo features

Feature	Default	Brings in
`fetch` (existing)	off	`reqwest`, `tokio`, `async-trait`
`dns` (NEW)	off	`hickory-resolver`, `tokio`, `async-trait`

Verifier semantics

State	Effect
Absent record	No effect — DNS TXT is purely additive
Present + match	Verification succeeds; absence of mismatch is the trust signal
Present + mismatch	Hard failure (`Error::Discovery`)
Present + malformed	Hard failure (`Error::Discovery`)

The mismatch case is fail-closed because a publisher who intentionally publishes a TXT record has signaled DNS is part of their trust chain — divergence between DNS and `.well-known` indicates compromise of one channel and there's no way for the verifier to tell which is authentic.

QA

Check	Result
`cargo test -j2 --all-features`	141 lib tests pass (was 130; +11 new DNS tests covering all parse paths, multi-key match, kid-disambiguation, mismatch fail, txt_record_name behaviour, SchemaPin-record rejection sanity)
`cargo build -j2 --all-features`	clean
`cargo clippy --all-features -j2 -- -D warnings`	clean
`cargo fmt --check`	clean
`python3 -m json.tool context7.json`	valid

Backward compatibility

Purely additive — v0.2.0 verifiers ignore TXT records entirely; v0.3.0 publishers can adopt at their own pace.

Reader ↓ / Publisher →	No TXT	TXT matching	TXT mismatching
v0.2.0 verifier (no DNS check)	works	works (TXT ignored)	works (TXT ignored)
v0.3.0 verifier without dns_txt	works	works	works (check skipped)
v0.3.0 verifier with dns_txt	n/a	works	DOMAIN_MISMATCH

Threat model

Defends against:

• HTTPS-origin compromise (compromised hosting account, expired domain not removed from CDN, ACME ownership-validation bypass).
• TLS cert mis-issuance (rogue or coerced CA issues a cert for the publisher's domain to an attacker).
• CDN cache-poisoning of the static `.well-known` asset.

Does NOT defend against joint compromise of HTTPS + DNS or targeted DNS hijack at the verifier (use DNSSEC, DoH/DoT, or pinned recursive resolvers in high-stakes deployments).

Versions

All three SDK manifests bumped to `0.3.0-alpha.1` (CI enforces consistency). JS and Python ports of the `dns` module follow in subsequent alphas; the version tag aligns the alpha cycle.

Spec / docs

• `CHANGELOG.md` — new `0.3.0-alpha.1` entry covering the DNS TXT surface (this PR's content).
• `SKILL.md` — frontmatter version + stable_version, description expanded.
• `context7.json` — description expanded with the DNS TXT surface.

Test plan

• All cargo features build and test green
• Clippy + fmt clean
• context7.json valid
• Cross-language interop test — deferred to JS/Python ports
• Real DNS integration test against a controlled fixture — deferred (mirrors the SchemaPin v1.4-alpha.1 deferral for the same reason)