feat(auth): prepare v2 credential shape validation for Phase 3

[purpshell]

Summary

Phase 3 draft. Do not merge or publish. Prepare TypeScript and Go/Python/PHP/Rust/C# organization/project validators for variable-length signed v2 credentials and reject v1 shapes. Validation checks framing only; the API authenticates signatures, purpose, context and live issuance records. Client tokens remain opaque with their existing prefix checks.

Stack dependency: native SDK PR #348 at 0822c934f25e0a8fa70ae4a799344ccb54f215bb is unmerged. This draft is stacked on that source and must wait for it. MR-C changes are the commits after that baseline; use that compare when reviewing. API codec contract: polymorfa/polymorfa#638 47d34d0a1fe29579611b3296ca61ab2bd5eefcf9. API cutover: polymorfa/polymorfa#647, also held draft.

Impact table

Part	State and evidence
API	Contract pinned; public issuance change held for Phase 3. SDKs contain no signer/private key or authority decision.
SDKs	Updated TS plus five native validators, public golden org/project tokens, v1/padding/size failures and matching transport fixtures. No fixed v1 parser remains in these sources.
CLI	Publication blocked. CLI main 16596a61373afbf1a96054e9b923c0bdb1dcbc73 delegates validation to this SDK. Its accepted published SDK pin must move with the cutover; no guessed unpublished version.
Docs	SDK READMEs and docs/mr-c-v2-credentials.md updated; matching customer/API documentation is in the API draft.
Feature releases	Held. Requires native baseline merge, accepted SDK publication and coordinated API/deployment release; no flag or registry changed.
Admin controls	Unaffected: SDK framing adds no customer state, permission, grant or staff operation. Existing API credential revocation remains authoritative.

No impact table

Surface	Reason
Browser/Calls client claim parsing	These packages transport opaque client tokens and use the stable prefix; they do not decode claims or enforce fixed client lengths.
Listener/media protocol	Existing separate ticket formats/secrets are unchanged.
Entitlements, billing, telemetry	This change validates credential framing and does not change access rules, prices or measurement.

Verification

• TS native-source stack: 2,022 tests pass / 113 optional skips on Node 24.15.0; typecheck and workspace builds pass; lint zero errors/two existing errors.ts warnings.
• Go: GOWORK=off go test -p 2 ./... passes, including shared golden and v1 rejection. Native example-host race tests pass.
• Python: 1,643 pass / 30 optional integration skips; Ruff checks/format and mypy pass.
• Rust: default-feature full tests/doctests and authenticated token-server example tests pass (cargo test --locked --jobs 2).
• PHP 8.2: full native transport, crypto/history and portable storage harness plus PHPStan pass; optional external providers skipped. Example dependencies installed before the run.
• C#: full native HTTP/core harness passes after building the required ASP.NET/Blazor assets, including signed-v2 golden/refusal checks and local authenticated example. No browser execution, native desktop acceptance or optional-provider matrix claimed.

No registry publication, live authenticated API acceptance, deployment, secret mounting or production use has been exercised. This draft is not a release-ready claim.

Session provenance

Codex gpt-6.1-sol in T3. Work is isolated under ~/.polymorfa-agent-work/mr-c/; original user worktrees preserved. The app thread ID is unavailable for transcript capture; no browser screenshot is claimed for a framing-only SDK change.

Latest CI is not green: Go 1.25 failed the unchanged media-upload deadline
assertion at packages/go/media_upload_test.go:299 (invalid-upload-location
classification instead of timeout). The pinned native baseline passed 20 focused
Go 1.25.14 race runs locally; this does not establish the CI failure's cause.
Go 1.24, both Python and PHP jobs pass; Rust matrix jobs are still running.
The Calls setup scripts now delegate server-key validation to the SDK, with a
new rejection/golden test included in CI. No review or re-review was requested.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}