Add scoped Gemini identity and trust state

[mark-ik]

Summary

• derive capsule-scoped Gemini client identities from Personae
• require explicit approval before certificate presentation and support deliberate reuse
• persist exact-target Gemini trust decisions and carry typed certificate-change state
• consume gemini-protocol 0.1.5 through Errand 0.3.3

Verification

• Errand: 59 tests passed; 1 intentional live-network test ignored; 1 doctest passed
• real local TLS client-certificate presentation proof passed
• package dry-run passed for the published crate
• published Errand 0.3.1 and 0.3.2; latest corrected release is 0.3.3