Issue or revoke

Only wallets holding ISSUER_ROLE on the registry can write. Each issue creates a revocable EAS attestation with the credential type and evidence URI in the payload; the registry is the attester, and the schema's resolver rejects anyone else.