Standardize on American spelling (#104)

## Summary

Applies our house spelling convention (American English) to docstrings
and one test comment. The docstrings ship inside the published package,
so this is user-visible in the same small way a README typo is.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. No exported name, signature, wire format, or response shape
changed. The edits are docstring prose plus one comment in a policy
test.

## Test plan

Full suite run locally: 1841 passed, 4 skipped, coverage 95.36% against
the 95% floor. Ruff format and check both clean. No new tests, since no
behavior changed.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

agentscore_commerce/aip/http_signature.py

@@ -21,7 +21,7 @@
 ``Signature-Input`` / ``Signature`` dictionaries (a parenthesized inner list + integer/string
 params, and a single byte-sequence value). It is not a general RFC 8941 parser.
 
-Byte-compatibility: this is a behaviour-exact port of the reference ``aip/http-signature.ts``.
+Byte-compatibility: this is a behavior-exact port of the reference ``aip/http-signature.ts``.
 A node/pay-signed proof-of-possession MUST verify here and vice versa. The signature base,
 component ordering, canonicalization, the standard (not base64url) base64 of the signature
 value, and the RFC 7638 thumbprint are all reproduced byte-for-byte.

agentscore_commerce/aip/jwks.py

@@ -18,7 +18,7 @@
 
 Pure-ish: the only I/O is the HTTP fetch, injectable for tests via ``fetch_impl``.
 
-This is a behaviour-exact port of the reference implementation; the canonicalization,
+This is a behavior-exact port of the reference implementation; the canonicalization,
 caching, and selection logic mirror that file line-for-line so an AIT verified by one SDK
 resolves the same key set in the other.
 """
@@ -225,7 +225,7 @@ def json(self) -> Any:
 class JwksCache:
     """JWKS resolver bound to a trusted-issuer allowlist.
 
-    One instance can serve many issuers; each issuer's key set is cached independently. Behaviour
+    One instance can serve many issuers; each issuer's key set is cached independently. Behavior
     mirrors the reference ``JwksCache``.
     """
 

tests/test_policy.py

@@ -224,7 +224,7 @@ async def test_run_gate_soft_does_not_swallow_sanctions_unavailable() -> None:
 @pytest.mark.asyncio
 async def test_run_gate_soft_does_not_swallow_signer_sanctions_error_code() -> None:
     # A signer-sanctions SDN deny that surfaces as a top-level error.code (not in reasons)
-    # is still recognised as a sanctions deny and stays terminal under soft.
+    # is still recognized as a sanctions deny and stays terminal under soft.
     from agentscore_commerce.identity.fastapi import _GateDenialError
 
     body = {"error": {"code": "sanctions_flagged", "message": "signer on SDN list"}}