Clarify product boundary and reference separate VerifyAgent repo

[GsCommand]

Motivation

• Separate the public VerifyAgent verifier/demos from the commercial protocol repository and clarify that this repo governs CommandLayer Commercial infrastructure only.
• Prevent confusion about a standalone public verifier/UI being shipped from this repository by pointing public receipt verification users to the dedicated VerifyAgent repository.

Description

• Added an "Unreleased" changelog note and updated CHANGELOG.md to record that VerifyAgent has been separated into its own Commons/MIT repository and to clarify repo scope.
• Updated multiple repository docs (README.md, SPEC.md, POLICY.md, COMPLIANCE.md, CONTRIBUTING.md, GOVERNANCE.md, INTEGRATOR.md, ONBOARDING.md, RESOLUTION.md, SECURITY.md, SECURITY_PROVENANCE.md) to explicitly state the product/architecture boundary and to refer public receipt verification users to https://github.com/commandlayer/verifyagent.
• Added concise "product boundary" and "usage/architecture" guidance in the README and integrator/onboarding docs to distinguish the public verifier (VerifyAgent) from the paid CommandLayer Commercial infrastructure.

Testing

• Documentation-only change; ran repository validation commands npm test and npm run validate:schemas as part of the pre-merge checks and they completed successfully.

---

Codex Task