DID resolver: cache negative lookups with TTL

DID resolver: cache negative lookups with TTL. The escrow accepts the merge cert only when the gitlawb oracle quorum signs a certificate proving that a PR resolving #88 landed on main.

• Tests must stay green on the target branch after merge.
• No new direct dependencies without justification in the PR body.
• If race-eligible, the first valid merge wins; honest losers refunded gas.