[sumitvekariya]

Records signed by institutions that still host an older did.json fail here:

FAIL institutional_identity: did:web:<institution>#key-1 is not authorized by assertionMethod

Until 2026-06-30 the GAMI portal generated did:web documents without assertionMethod, with Ed25519VerificationKey2020 keys as bare publicKeyHex listed under authentication. The hosted verifier passes these records under its legacy rule (gami-app src/lib/did-resolve.ts, isAuthorizedForAssertion), so the CLI and the hosted verifier disagree on the same record.

This PR copies that rule into the CLI as a temporary measure:

• It applies only to did:web documents that declare no assertionMethod at all. A present assertionMethod, even an empty one, keeps the strict rule.
• The record's key id must be listed under authentication, and the verificationMethod with that id must be an Ed25519VerificationKey2020 given as bare publicKeyHex holding exactly the record's embedded key. A matching id alone is not enough, any other key encoding fails, and the rule refuses to run without an embedded key.
• The PASS message says the temporary legacy rule was used and that the institution should re-publish.

Removal: once the remaining institutions re-publish their DID documents from the portal, delete isLegacyDocument, decodeLegacyKey, findLegacyMethod and the temporary legacy rule tests.

Checked: pnpm compile, pnpm lint, pnpm format and pnpm test (64/64, eight new). With live DID resolution, a record signed under such a document now passes all five checks; records from documents with assertionMethod are unchanged.

Release note: package.json on main says 0.4.0, while npm has 0.4.1 and the v0.5.0 tag points at a commit whose package.json says 0.4.0. The release workflow's tag check would refuse that tag, which may be why 0.5.0 never reached npm. Releasing this needs a version bump on main first.