Add AAuth Events support as an extension NuGet package

[nedruk]

Summary

Build a preview AAuth.Events NuGet package that extends the AAuth NuGet package with support for the experimental AAuth Events specification:

aauth-spec/v09/draft-hardt-aauth-events.md

The package will support Agent Provider, resource, and agent protocol roles without adding Events-specific functionality to the core AAuth package.

Scope

• Subscribe-token creation and verification
• Public and protected subscription registration
• Event-token creation and signed resource-to-AP delivery
• Agent Provider event endpoint and durable inbox contracts
• Atomic max_uses enforcement and idempotent delivery
• Agent-side event verification and deduplication
• AP metadata and AsyncAPI integration helpers
• ASP.NET Core endpoint and DI helpers
• Conformance, integration, and adversarial tests
• Runnable Bookings, Agent Provider, and EventAgent sample flow
• NuGet packaging, release workflow, and documentation

Acceptance criteria

• AAuth.Events is independently packable and depends only on AAuth.
• Subscribe and event tokens conform to the vendored specification.
• Signed requests enforce required covered components and payload digests.
• Public and protected subscription flows are supported.
• The AP records events durably before returning 202 Accepted.
• max_uses, subscription expiry, replay, and concurrent delivery are handled atomically.
• Agent verification validates issuer, signature, audience, timestamps, and event context.
• Events-initiated metadata, JWKS, and delivery requests enforce the documented URL security policy.
• AsyncAPI metadata and security declarations can be composed and validated.
• Tests cover all in-scope normative requirements and selected draft interpretations.
• Samples demonstrate a complete protected waitlist subscription and event-delivery flow.
• The package is built, tested, packed, and released with the same version as AAuth.
• The core AAuth package remains unchanged.

Out of scope

• Standardizing AP-to-agent token acquisition or event transport
• Production-specific durable storage implementations
• Full AsyncAPI document generation or schema validation
• SSE, WebSocket, mobile push, webhook, or queue adapters
• Payload encryption

Planning documents

• .agent/plans/2026-07-14-aauth-events/research.md
• .agent/plans/2026-07-14-aauth-events/implementation-plan.md