port notary runtime to protocol-based providers

[aniketh-maddipati]

Summary

This PR ports the receipt runtime onto the protocol-based provider architecture while preserving the existing Notary surface that the tests, demo, and docs already exercise. The end result is that plans, receipts, chain handling, policy evaluation, serialization, key management, timestamping, redaction, and sinks now flow through explicit protocol-shaped implementations instead of the old monolithic notary internals.

For users, this keeps the current Notary workflow working while making the runtime easier to audit, extend, and verify. Existing receipt behavior such as signing, per-plan chaining, evidence export, delegation, session tracking, co-signatures, and healthcare demo flows continue to work, but the implementation is now split across concrete provider modules and dedicated plan/receipt/chain/policy models.

Root Cause

The repository had already introduced protocol interfaces, but the runtime was still effectively running on the legacy implementation. Provider modules were mostly stubs, plan lifecycle lived in placeholder code, receipt semantics were still embedded inside agentmint/notary.py, and the AERF conformance test remained marked xfail because the migration was incomplete.

That meant the public architecture and the actual implementation had drifted apart. The runtime behavior existed, but it was not yet expressed through the provider boundary and model layer that the migration expected.

Fix

The runtime was reworked around the new architecture in a compatibility-preserving way:

• implemented concrete provider modules for keys, sinks, timestamps, serializers, and redaction
• added dedicated Plan, Receipt, chain, and policy modules
• rewrote Notary to use those providers and models while retaining legacy entry points such as create_plan, notarise, verify_plan, verify_receipt, evidence export, and delegation helpers
• added a @notarise decorator helper and exported it from the package surface
• restored compatibility helpers used by the demo and tests, including plan short_id, chain verification, plan/receipt aliases, and expected empty-string defaults for optional signature fields
• updated the AERF conformance test to validate the now-conforming receipt path and added direct tests for the provider implementations

Validation

I validated the migration with:

• python3 -m pytest -q
• python3 -m agentmint.demo.healthcare

Both completed successfully in the local workspace.

Notes

I also attempted to run vet, but the local agentic run was blocked by environment quota/harness limitations rather than a code issue, so the main validation signal here comes from the full pytest run and the healthcare demo flow.