test(rp-registration): pin a real signed WRPRC as a golden fixture

[luisgf]

Value/Effort: medium / S — gated on a real signed WRPRC existing. Follow-up to #89, which shipped openvc.rp_registration (ETSI TS 119 475 V1.2.1 clause 5.2) in v1.21.0.

#89 landed against self-made vectors plus the Annex C payload, because no signed third-party WRPRC exists yet:

• the ETSI deliver folder ships only the PDF; Annex C is informative and unsigned (and, as printed, not valid JSON — a trailing comma and a stray brace in the header, plus "x5c": []);
• the 2026 EAA Plugtests (4 May – 30 Jun) covered TS 119 472-1, not 119 475;
• CIR (EU) 2025/848 applies 2026-12-24, and its Art. 8 makes registration certificates optional per Member State — so genuine artifacts are unlikely much before then.

Per the project's golden-fixture discipline (conformance pinned by recorded real vectors, not synthetic shapes), this tracks replacing the self-made vectors with a real one. Same pattern as #121.

Scope when unblocked:

• Record one real signed WRPRC (JWT form at minimum) with provenance, as a golden fixture.
• Verify it end to end against the issuing registrar's published anchors.
• Reconcile whatever the real artifact disagrees with — in particular the three places feat: parse EUDI relying-party registration certificate (WRPRC) — JWT/CWT entitlements (ETSI TS 119 475) #89 had to make a judgement call:
  • intermediary.sname (Table 10) vs intermediary.name (Annex C), and intermediary.sub vs act.sub (GEN-5.2.4-09). We currently read both spellings of each; a real artifact says which one issuers actually emit.
  • The JAdES header iat. TS 119 182-1 clause 5.1.11 mandates it for signatures made after 2025-07-15 and 5.2.1 forbids sigT, but TS 119 475 Table 5 omits iat entirely. We surface it and do not require it. A real artifact settles whether issuers follow JAdES or Table 5.
  • Whether crit appears at all, and with which names — JAdES V1.1.1 required non-registered header params to be listed there and V1.2.1 suppressed that, so V1.1.1-era issuers may still emit it. Our allow-list is {alg, typ, x5c, iat}.

Separately gated — the CWT form. TS 119 475 presents its claim tables once, format-agnostically, with text field names, and never allocates CBOR integer labels for its own claims; TS 119 152-1 (CBOR AdES) is a forward reference. The envelope (RFC 9052 + RFC 9360) is fully specified and implemented, and _normalise_cwt_claims accepts both the RFC 8392 registered integer keys and text keys — the only reading available to an issuer today — but that lane is provisional and untested against any real producer. If ETSI publishes a claim-key mapping, revisit it.

Watch: a Member State registrar going live post-2026-12-24; a future Plugtests round covering 119 475; TS 119 152-1 reaching a stable CBOR-AdES profile; ETSI erratum on the sname/name/act.sub contradictions.

Depends on: #89 (done, v1.21.0).