Add active SDK integration challenges

[danifronter]

What changed

• Add a typed, short-lived, app-bound integration verification challenge.
• Bind authenticated SDK evidence heartbeats to one-time Central challenges.
• Validate Central acknowledgement and expose exact success/failure status.
• Document the signed-webhook verification flow and publish SDK runtime version 2.8.0.

Why

Central needs fresh runtime proof for every external application. A health probe or a cached heartbeat cannot prove that the configured SDK, contract, and catalog are running together.

Validation

• composer verify
• PHPCS: passed
• PHPStan: passed
• PHPUnit: 34 tests, 100 assertions