fix(identity): validate kid/kty are non-empty strings in UCPSigningKey.from_jwk

Previously only checked key presence, not type. A JWK with kid=None or
kid="" would fall through to the dataclass and serialize to invalid JSON
during JCS canonicalization (signing would still succeed, producing a
profile that verifiers cannot parse). Tighter validation matches the node
sibling's `typeof jwk.kid !== 'string' || !jwk.kid` check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vvillait88

agentscore_commerce/identity/ucp.py

@@ -81,11 +81,11 @@ def from_jwk(cls, jwk: dict[str, Any]) -> UCPSigningKey:
         if not isinstance(jwk, dict):
             msg = f"UCPSigningKey.from_jwk expected a dict; got {type(jwk).__name__}."
             raise ValueError(msg)
-        if "kid" not in jwk:
-            msg = "UCPSigningKey.from_jwk: JWK missing required field `kid`."
+        if not isinstance(jwk.get("kid"), str) or not jwk["kid"]:
+            msg = "UCPSigningKey.from_jwk: JWK missing required field `kid` (or non-string/empty)."
             raise ValueError(msg)
-        if "kty" not in jwk:
-            msg = "UCPSigningKey.from_jwk: JWK missing required field `kty`."
+        if not isinstance(jwk.get("kty"), str) or not jwk["kty"]:
+            msg = "UCPSigningKey.from_jwk: JWK missing required field `kty` (or non-string/empty)."
             raise ValueError(msg)
         if jwk["kty"] not in {"OKP", "EC", "RSA"}:
             msg = (