Reference implementation tracking

[atef-ataya]

Tracking the AIT reference implementation in depwire-cli.

Planned features:

• depwire ait init — generate RS256 key pair for signing
• AIT-S token generated on depwire mcp session start
• AIT-A token generated per MCP tool call
• depwire ait verify <token> — offline chain verification
• depwire ait export — audit log as JSON/SARIF

Library: jose (JWT signing, zero native dependencies)

Will implement after HN/community feedback on the spec itself.