Require provemark/content-credentials ^0.20 and provemark/c2pa-verifier ^0.10

Generated with the help of an LLM.

Problem/Motivation

provemark/c2pa-verifier 0.10.0 (2026-10-29) carries the fixes of a security review of its whole code. Six of them are for files it wrongly called "Trusted". Since 0.9.0, a signer issued directly by a trust anchor, whose file carries only its own certificate and a stapled revoked status, is "Invalid" where it was "Trusted". On the verifier route a wrong "Trusted" becomes a suggestion.

This module asks for verifier ^0.8 and library ^0.19.5. Every library 0.19.x refuses verifier 0.9 and up, so a site cannot reach verifier 0.10 at all. Dry run with only the library and the verifier, no Drupal site yet:

• library ^0.19.5, verifier ^0.10: refused, "provemark/content-credentials[v0.19.5, ..., v0.19.6] conflict with provemark/c2pa-verifier v0.10.0"
• library ^0.20, verifier ^0.10: Composer picks library 0.20.0 and verifier 0.10.0

Proposed resolution

Require provemark/content-credentials: ^0.20, and provemark/c2pa-verifier: ^0.10 in require-dev and in the install sentences (settings form, missing-package message, README), with amendments to SPEC-013, SPEC-016 and SPEC-019. No code change: library 0.20.0 only adds to the verifier reader, and this module calls nothing that changed. In the README, the recommended ai_disclosure release was measured on beta1; beta2 has since been measured too.

Remaining tasks

• Run the version pins red first, then green.
• Run the full test suite on Drupal 11.3 and 11.4 with library 0.20.0 and verifier 0.10.0.
• CHANGELOG under Unreleased.

User interface changes

The install sentence for the verifier route on the settings form asks for ^0.10.

API changes

None.