Replace trusted identity objects with canonical raw bytes

[Pigbibi]

Scope

Fresh raw-canonical-bytes replacement for the frozen PR #32 A0 contract.

• fixed repository/workflow path/ref constants;
• canonical raw-byte builder, parser, and operation-boundary validator;
• explicit reviewed workflow SHA evidence;
• complete mapping shape/type/size validation before serialization;
• duplicate/noncanonical/unknown/missing/tampered/forged input fail-closed with sanitized errors;
• no Python object identity, singleton, capability, registry, bundle, workflow, permissions, Actions, or A1 integration.

PR #32 remains closed/frozen and is not reused.

Verification

• focused raw identity pytest: 25 passed
• full python3 -m pytest -q: 112 passed
• locked uv pytest: 112 passed
• compileall: passed
• diff-check: passed
• ruff: unavailable

A1 bundle integration remains blocked until this foundation is merged and post-merge main CI succeeds.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR