feat(vsa): migrate to single in-toto 0.0.2 entry storage

- Replace dual in-toto 0.0.1 + DSSE 0.0.1 entries with single in-toto 0.0.2
- Return `ssldsse.Envelope` directly from retrieval instead of JSON
- Remove `VSAWithSignatures` and dual-entry pairing logic
- Eliminate redundant DSSE reconstruction in hot path
- Update signature verification to use `ssldsse.Envelope` directly
- Leverage in-toto 0.0.2 native DSSE envelope support

This migration simplifies VSA storage and retrieval by consolidating
to one entry per VSA. Signature verification and payload inspection
remain supported via the DSSE envelope embedded in the entry.

Assisted by: claude-4-sonnet

Author: joejstuart