a2ui trust gate — reference verifier

Single-file reference implementation of RDR-004's verify_payload in JavaScript. Paste a signed a2ui surface payload below; the page verifies the Ed25519 signature against the inline trust.publicKey, cross-checks the producerId fingerprint, and reports freshness. No trust-store policy is applied here — that's a host bridge concern (see web/host-bridge.html).