Remove the unused identity-token gate

[vvillait88]

Summary

Removes the unused identity-token path from the merchant SDK.

• Checkout: the gate option for it, its offline verifier and key cache, the per-issuer policy override that applied only to it, and its deny bodies. A gate is back to wallet and operator-token identity only, with its own compliance fields sent as before.
• Adapters: the dedicated gates and accessors in all five framework adapters.
• Advertising: the A2A agent-card extension builder, and the token path in the agent-memory hint, missing-identity instructions, llms.txt, skill.md, mpp.json and OpenAPI security schemes.
• hasIdentityHeader: no longer counts that header.
• Dependency: takes @agent-score/sdk ^2.9.0, which drops the same input.

Version 3.1.0: a minor, because no merchant uses it. The content-type passthrough on deny responses stays, since a merchant's own onDenied can still set one.

Worked with Varun, who asked for the feature to be removed everywhere.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Removes the gate option and its exported verifier, signing, key-cache and type surface, the adapter gates and their accessors, the agent-card extension builder and URI, and the token flag on the discovery builders (agentscoreSecuritySchemes now takes no options).

Test plan

lint, typecheck, knip, test (1636 passed, 4 skipped) and build, all green locally. A replacement test pins that only an operator token or a wallet address counts as an identity.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests