Add TrustBundle model to authority spec with validation

[aidankhogg]

Motivation

• Introduce a first-class model for imported cross-world trust metadata so peers can declare DNS suffixes and trust anchors for peered or federated boundaries.
• Enforce minimal correctness rules for cross-world trust configuration to prevent invalid or incomplete federated trust declarations.

Description

• Add TrustBundle Pydantic model to netengine/spec/authority.py with fields peer_id, peer_name, mode, dns_suffixes, peer_root_ca, oidc_issuer, accepted_audiences, mail_domains, and dkim_policy.
• Implement @model_validator(mode="after") on TrustBundle to require mode be peered or federated, to require non-empty dns_suffixes, and to require at least one trust-bearing field (peer_root_ca or oidc_issuer) for federated bundles.
• Export TrustBundle from netengine/spec/__init__.py so it is part of the public spec API.
• Add unit tests in tests/test_authority_spec.py covering valid peered and federated bundles and invalid cases for none mode, empty dns_suffixes, and federated bundles missing trust metadata.

Testing

• Ran pytest tests/test_authority_spec.py -q and all authority-spec tests passed (22 passed).
• The new unit tests exercise both acceptance and rejection paths for TrustBundle validation and succeeded.

---

Codex Task