Deterministic attestation issuance - remove time.time()/uuid.uuid4() defaults from create_attestation

[rahuldass19]

Summary

create_attestation defaults issued_at to time.time() and jti to uuid.uuid4().hex[:12] when callers omit them. This means identical inputs produce different attestation payloads and identifiers, violating QWED's deterministic issuance contract.

Background

Identified during PR #249 (QWED Security alerts cascade) by coderabbitai review. The fix was deferred because it requires a non-trivial API change.

"Requires callers to explicitly pass issued_at and jti, or inject clock/ID providers. Touches every create_attestation call site. It's a design improvement, not a security fix — better scoped to a follow-up."

Scope

1. src/qwed_new/core/attestation.py: Remove time.time() and uuid.uuid4() fallbacks from create_attestation.
2. tests/: Update all call sites that rely on the implicit defaults — they must now pass explicit issued_at / jti values.
3. Injection API: Optionally provide a mechanism to inject clock (Callable[[], int]) and ID (Callable[[], str]) providers for deterministic testing.

Acceptance Criteria

• create_attestation raises TypeError (or a custom error) when issued_at or jti are not provided
• All existing tests pass with explicit issued_at / jti values
• Test coverage for callers that fail to provide required arguments
• Optional: injectable clock/ID provider for deterministic test scenarios

References

• PR fix: QWED Security alerts — credential-like strings, JWT decode, .dockerignore #249 (parent PR where this was identified)
• coderabbitai review on commit 450ce5b: "Keep attestation issuance deterministic"
• src/qwed_new/core/attestation.py lines 277-279 (original time.time() call)
• src/qwed_new/core/attestation.py lines 277-279 (original uuid.uuid4() call)