feat(cose): implement the v0.2 COSE envelope behind the version gate (#243 phase 2) - #274

This PR is awaiting a named-maintainer review of the current head commit. This is a policy gate, not a CI failure: the PR is mergeable once a named maintainer approves. Approvals of earlier commits do not count after new pushes. See CODEOWNERS or MAINTAINERS.md for the list of maintainers.