fix(sign): reject unsatisfied TUF service requirements

[wolfv]

Summary

• Support ANY and EXACT with count 1 during TUF signing-config conversion.
• Reject missing, zero, or larger exact counts before selection metadata is discarded. Multi-service signing is not implemented by this PR.
• Require eligible Rekor and TSA endpoints rather than silently omitting a requested service. Manually constructed signing configs retain optional TSA support for Rekor v1.

Regressions cover both conversion entry points, multiple available operators, and missing, expired, future, or unsupported endpoints.

Stack

Fix 5/6 from the crate review. Based on #217; merge the stack in order. This PR contains only its focused fix relative to its base.

Validation

• Targeted regression tests pass.
• cargo test --workspace --all-features --locked passes on the completed stack.
• Strict Clippy (--all-targets --all-features --locked -- -D warnings) passes for the changed crates.
• cargo fmt --all -- --check and git diff --check pass.