Add CLI utilities and Trust Mark tooling

[s-hal]

• Add CLI utilities for AFS-style inspection and config workflows.
• Add script to create/handle Trust Marks. Note: trust_mark_issuers expects { "<trust_mark_type_id>": ["<issuer_entity_id>", ...] }.
• Update message.py to inline _payload_from_jws() and remove dependency on entity.function.get_payload, breaking the message/claims circular import while preserving legacy AttributeError on non-JWS inputs.
• Wrapped trust_mark_issuers in dict() before including it in the entity statement payload. This guarantees a plain Python dict is passed to json.dumps, avoiding TypeError: Object of type AbstractFileSystem is not JSON serializable when the backing object is AbstractFileSystem or another dict-like.