dsse: pure-offline DSSE verify drags in the full 179-crate wsc dependency tree

[avrabe]

Found integrating wsc 0.9.4 as varve's manifest-verification library. wsc::dsse (DSSE sign/verify over arbitrary blobs — exactly what a downstream verifier wants) lives only in the full wsc crate, whose default build pulls 179 crates including ring, rustls 0.23, ureq 3, rcgen, x509-parser, p256, webpki-roots. The dsse module's actual dependencies are just base64, serde, serde_json, ed25519-compact.

Proposal: move src/lib/src/dsse.rs into wsc-verify-core (21 crates) or a new wsc-dsse microcrate, re-export from wsc for compatibility. Downstream offline verifiers (varve, kiln-style embedded consumers) get a ~21-crate footprint.

Related findings from the same integration, filed separately: in-library cosign-bundle verification is absent (SigstoreBundle is export-only), AirGappedVerifier::verify_crypto is a stub, no keyless blob signing, and ed25519_compact appears in public API without being re-exported.

🤖 Filed from varve v0.2.0 integration per report-tool-friction.

[avrabe]

Scoped for v0.11.0 as REQ-24 (rivet) — extract dsse into wsc-verify-core (or a new wsc-dsse crate) so offline/embedded consumers verify DSSE with just base64/serde/serde_json/ed25519-compact, not the 179-crate wsc tree. Pairs with REQ-23 (#219) and feeds #187's on-target verifier.