feat: add grammar-validated typed identity model

[Pigbibi]

Summary

• add the strict structured_tokens.v2 canonical identity model
• validate deterministic field-specific expression grammar in R1
• keep reviewer parsing and credential recognition outside this layer
• enforce exact canonical wire records and identity digests

Scope

Fresh R1d replacement for frozen PRs #84 and #85. Pure model and tests only; no runtime, history, evidence, adapter, or R2 integration.

Validation

• focused identity tests
• tests.test_run_codex_pr_review
• full unittest discovery
• ruff, compileall, actionlint, diff-check`

[github-actions]

🤖 Codex PR Review

🚫 Merge blocked: 1 serious issue(s) found in high-risk files

🚫 Blocking Issues

These issues must be fixed before this PR can be merged:

1. 🟠 [HIGH] Logic in scripts/canonical_typed_identity.py

_clause() reuses the broad OPERANDS set for every clause type, so validate_identity() accepts predicate clauses that are not valid predicate expressions, such as a bare policy_state token or identifier == secret_ref. This contradicts the PR's stated 'field-specific expression grammar' and means malformed payloads are turned into canonical contract_key/fingerprint_v2 values instead of failing closed, which can fragment identity matching across implementations. (line 109)

Suggestion: Split clause validation by field. For predicates, only allow the operand kinds that are actually part of the predicate grammar (for example, identifiers only, or another explicitly defined subset), and add negative tests covering policy_state and secret_ref inside predicates.

---

Review by Codex PR Review bot • PR

[Pigbibi]

Superseded by merged PR #87. This PR remains unmerged; its implementation is not imported.