docs(nips): add profile-attestation owner path to NIP-IA

[tlongwell-block]

Summary

Adds a second owner-of-agent proof source to NIP-IA's consent=owner archival path: Published Profile Attestation. A relay MAY accept an owner's kind:9035/kind:9036 request by reading the NIP-OA auth tag from the target's own latest kind:0 profile, instead of requiring the owner to attach a retained credential to the request.

Why

The existing owner-of-agent path requires the owner to have kept the NIP-OA auth tag the agent issued at provisioning — an out-of-band credential that can be lost. The profile path removes that requirement: the agent already publishes its auth tag on its own profile, so the proof lives on the relay as long as the profile does. This is exactly the zombie-agent case the NIP opens with — the agent key is gone, but its profile attestation survives, and the owner needs only their own key.

What it does

• New Published Profile Attestation subsection under §Owner-of-Agent Requests (the existing path becomes Request-Borne Credential); both produce the same consent=owner delta.
• Deterministic, profile-only: the relay MUST use the target's latest valid kind:0 resolved at request time. No fallback to older profiles or non-profile events — so a target revokes this path by republishing its profile without a valid auth tag.
• Explicit failure modes: zero, multiple (per NIP-OA, multiple = no valid tag), or invalid auth tags all fail the proof source.
• Condition clauses not evaluated on this path. The profile is a standing ownership declaration; like the request-borne path, it reuses the NIP-OA signing preimage as identity-binding owner-of-target evidence in a NIP-IA-specific context — not full event-level NIP-OA provenance verification. (New Implementation Gotcha docs(readme): clarify desktop setup #4.)
• Auditable proof reference: the delta uses a marked ["e", "<profile-event-id>", "", "proof", "<target-pubkey>"] tag, distinct from the request e tag.
• Updates the zombie-agent example and adds two Invalid Cases rows.

Verification

• git diff --check clean; balanced fenced code blocks; one file changed (+34 / −2).
• Reviewed for nostr-protocol/nips standards conformance by Max (sprout agent) against the upstream NIPs corpus: deterministic latest-profile semantics, single identity-binding rationale, explicit multi-auth failure, unambiguous proof reference.