feat(attesto3): register the REVIEW-02 disclosure v2 and ZK range domains

Sprint 1 recovery, first item. §5.2 of REVIEW-02 adds three domains the registry
did not carry: attesto.disclosure.v2, attesto.zk.range.v1.statement and
attesto.zk.range.v1.transcript.

They are not in the attesto.provenance.v1. namespace, and that is deliberate:
disclosure v2 and the ZK range protocol are separate protocols with their own
versions, so a preimage space is named after the protocol that owns it rather
than the one it happens to travel with.

That namespace difference meant the parity contract could not see them at all —
its pattern matched attesto.provenance.v1.* only, so three new domains would have
been silently unguarded. The pattern now names each protocol explicitly rather
than loosening to a prefix wildcard: a looser first attempt also matched prose
that mentions a namespace without a terminal segment and reported it as an
unknown domain.

All four registry locations updated together with the golden vector, and all
three SDK parity suites plus the contract are green. The Go failure message was
also corrected: it printed "rust=21 go=21" while failing on a third hardcoded
expectation it never named.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

provenance.go

@@ -48,6 +48,9 @@ var ProvenanceDomains = map[string]struct{}{
 	"attesto.provenance.v1.evidence_tree":   {},
 	"attesto.provenance.v1.policy_tree":     {},
 	"attesto.provenance.v1.attestation":     {},
+	"attesto.disclosure.v2": {},
+	"attesto.zk.range.v1.statement": {},
+	"attesto.zk.range.v1.transcript": {},
 }
 
 // TopLeafRoles is the canonical order of the six typed top-tree leaves. No