fix(json_logic): sigma DoS hardening + canonical node encoding

[ottobot-ai]

Summary

Production-hardening remediation from the 2026-06-17 Fiat-Shamir audit of the Σ-protocol opcodes (prove_dlog_verify / prove_dhtuple_verify / sigma_verify).

The audit's Fiat-Shamir / CDS soundness verdict was clean — strong transcript binding, 31-byte injective challenge, canonical z, reconstructed commitments, identity-point rejection, explicit CDS split checks. No soundness change in this PR. These changes close the separately-reported production-hardening + documentation findings so the opcode can be called production DoS-hardened.

Findings addressed

ID	Severity	Fix
IMPL-1	High	Bound the proposition raw node-count/depth (4096/64) BEFORE parsePropNode; depth-cap the gas estimator's proposition-shape walk by the same value (it runs before gas is consumed). boundProofShape → boundRawShape (bounds prop + proof).
IMPL-2/5	Med	Reject any field outside the canonical schema in every prop/proof node — removes the proof-bound-inflation surface (leaf with a bogus children) and makes the raw encoding canonical.
IMPL-3	Med	Cap the sigma message at 4096 bytes (SigmaMaxMessageBytes, shared by sigma_verify + prove_dhtuple_verify).
DOC-1	Med	Vector metadata root challenge mod R → low31(SHA256(…)).
DOC-2	Low	RFC vector references → the sigma categories of zk_opcode_test_vectors.json.
DOC-3	Low	RFC: proof tree carries per-leaf responses (commitments are reconstructed).
DOC-4	Low	RFC status lists the TypeScript impl; verifyTree comment mod R → low31; threshold share-index test prose corrected (indices are implicit child positions).

Tests

• 4 new shared conformance error-vectors (unknown-field on a prop leaf, unknown-field on a proof node, leaf-with-bogus-children, over-long message) — locked cross-language (Scala + Rust + TS).
• 6 new SigmaVerifySuite cases pairing a clean baseline (parses → Right) with the malformed variant (→ Left).
• Full suite 1210 green; scalafmtCheckAll clean.
• The proposition depth cap is unit-tested per language (it can't be a shared vector — exceeding sigma depth 64 implies ~128 JSON levels, beyond serde_json's parse recursion limit; both languages still reject, just at different layers).

Sister PR: metakit-sdk (Rust + TypeScript mirror + shared vectors).

🤖 Generated with Claude Code