fix(verify): reject unsupported receiptVersion values (closes #53)

[akuraposo]

Summary

Fixes #53: the local reference verifier in pp-cli only checked
receiptVersion as a required signed field, not as a required v1
constant. A signed, unexpired receipt with receiptVersion: "v2" (or
any other unsupported value) was accepted by pp verify as long as
canonicalization was jcs_v1, signatureAlg was ed25519, the
signature verified, and the receipt was not expired or revoked.

That means a verifier claiming pp-receipt-v1 compatibility could
silently accept receipts from an unsupported receipt-version
namespace, downgrading the local trust boundary.

Fix

Added a RECEIPT_VERSION = 'v1' constant in src/verify.ts and an
explicit version check after the canonicalization check. The
verifier now fails closed with MALFORMED_RECEIPT and exit code 3
if any value other than "v1" is supplied.

The constant value matches the v1 receipt spec at
https://github.com/permission-protocol/receipt-spec, which states:

receiptVersion for this specification is "v1".
Constraints: MUST equal "v1" for this spec

Validation

• npm test -- --run — all 6 tests pass (5 pre-existing + 1 new
  regression test that forges receiptVersion: "v2" on a valid
  receipt and expects MALFORMED_RECEIPT)
• npm run build — clean
• git diff --check — clean

Bounty

Submitted for assessment under #36 as a distinct Ed25519
verification-flow flaw. Payout details can be provided privately
after validation.