refactor: remove allow_raw_access

[lwshang]

Summary

allow_raw_access was carried over from the old SDK assets canister. It let an asset owner block serving from the .raw.ic* domain by redirecting raw-domain requests to the certified domain. We don't plan to support it anymore, so this removes the feature end to end — including the raw-domain redirect machinery it was the sole user of.

Changes

• canister-core
  • Drop the field from Asset / AssetDetails, the wire types (CreateAssetArguments, AssetProperties, SetAssetPropertiesArguments), stable state, and state-hash input.
  • Remove both raw→certified redirect checks from build_http_response (direct asset hit + redirect-rule target) and the now-unused req: HttpRequest parameter.
  • Delete the orphaned raw-domain helpers in http.rs that only existed to support it: is_raw_domain, redirect_from_raw_to_certified_domain, get_canister_id, build_redirect, get_header_value, and the HTTP_REDIRECT_PERMANENT const.
  • Remove the allow_raw_access test module and its now-unused helpers.
• sync-core — drop the field from the canister wire types; stop emitting it in create/property-drift operations.
• assets.did + e2e — drop the field from the candid interface and the e2e helper struct.

Behavior change

Assets are now always served on the raw domain without redirect, since per-asset raw blocking no longer exists. Consistent with the repo's no-backward-compatibility stance (no production instances), no shim is left behind. The adjacent enable_aliasing / is_aliased ignored-compat fields are intentionally left untouched.

Testing

• cargo build --workspace — clean
• cargo clippy --workspace --all-targets — no warnings
• cargo test -p canister-core — 99 passed
• cargo test -p sync-core — 190 passed
• cargo test -p canister — candid_interface_compatibility passes (trimmed assets.did matches the exported interface)
• cargo test -p e2e — 12 passed against a live local replica

🤖 Generated with Claude Code