Zone::delegated already refuses a zone that is not at or below the PDS hostname, at construction rather than at first mint, but nothing named the epic's own example: a server at pds.example.com asking for agents.example.com, siblings under example.com rather than one containing the other. Also adds a conformance suite validating the did:web documents this crate builds directly against the did:web method specification and the atproto identity specification, since neither the vendored interop vectors nor vectors/ carry a suite for document shape or handle resolution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: I8ff8291532d93009888c8f496748aaca021e4b0a