fix: verify proxy dispatch tickets

[RobLe3]

Summary

• verify directory-signed route tickets and policy-manifest bindings before the packaged proxy uses disclosed routes
• route the peer cache through the same DirectoryClient so ticket, fallback, and validation semantics cannot drift
• retain explicit rollback through IICP_ROUTE_DISCOVERY_MODE=legacy; automatic fallback occurs only when a directory lacks ticket support
• update the proxy documentation and unreleased changelog

Security boundary

Invalid tickets, invalid directory keys, policy-binding mismatches, and deterministic ticket refusals do not downgrade to route-bearing discovery. The change does not alter the wire protocol or the behavior of the core IicpClient ticket path.

Evidence

• uv run --locked --extra dev ruff check src tests scripts
• uv run --locked --extra dev pytest -q — 1156 passed, 2 skipped
• uv run --locked --extra dev python scripts/check_mypy_baseline.py — 74/74 existing findings, no regression
• uv run --locked --extra dev python scripts/run_sdk_quality.py --output /tmp/iicp-python-0.7.103-ticket-verification-quality.json — Python 3.11/3.12/3.13, 75.47% coverage, dependency audit, locked build and clean install passed

Sentrux is not configured in this standalone repository: sentrux . gate stopped because .sentrux/baseline.json does not exist. No baseline was created or replaced.

Relates to RobLe3/iicp.network#612.