fix(auth): register platform identity specs + issuer-from-env in TemperPaw (ARN-255)

[rita-aga]

Makes ARN-255 JWT verification functional in prod. The prod host skips the default agent-specs bootstrap (paw-agent owns the agent lifecycle), so the kernel's TrustedIssuer + PrincipalGeneration specs never loaded — tdata/TrustedIssuer was EntitySetNotFound and bootstrap_trusted_issuer_from_env had nothing to act on.

• Registers ONLY the two identity specs via the public SpecRegistry merge path (cascade-free; avoids the documented 512MB Railway OOM; does not resurrect the 8 built-in specs prod drops), then calls bootstrap_trusted_issuer_from_env (no-ops when TEMPER_TRUSTED_ISSUER_* env is unset).
• Fixes the datadog_observability_contract + paw_fs_hot_path pin assertions and 27 os-apps wasm Cargo.lock files that still referenced pre-bump rev 724eda61 (my chore(deps): bump temper pin to a6e62899 (ARN-255 kernel token verification) #467 updated Cargo.toml pins but not these; temper-wasm-sdk is byte-identical between the revs).

Under three-reviewer + Greptile review now. Part of the ARN-255 deploy chain.

🤖 Generated with Claude Code

Greptile Summary

The PR makes production JWT verification bootstrap the required platform identity state and synchronizes the repository on a newer Temper revision.

• Registers identity specifications when the paw-agent-owned lifecycle skips the default specification bootstrap.
• Registers operator credential specifications before creating the configured credential and propagates bootstrap failures.
• Loads the trusted JWT issuer from deployment environment variables before readiness.
• Aligns native and WASM dependency pins, lockfiles, and revision contract tests.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up-review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/temperpaw/src/startup.rs	Adds ordered identity, credential, and trusted-issuer bootstrap steps whose failures prevent the service from becoming ready.
crates/temperpaw/Cargo.toml	Moves Temper dependencies to one revision and adds temper-spec for targeted identity-spec registration.
Cargo.lock	Resolves the native Temper dependency family at the newly pinned git revision.
crates/temperpaw/tests/datadog_observability_contract.rs	Updates native and WASM pin-consistency assertions to the new Temper revision.
crates/temperpaw/tests/paw_fs_hot_path.rs	Updates the paw-fs dependency revision contract to the new Temper pin.
os-apps/paw-agent/wasm/context_compactor/Cargo.lock	Aligns the standalone WASM lockfile with the repository-wide Temper SDK revision.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Restore platform state] --> B{Skip default agent specs?}
    B -- No --> C[Default specs available]
    B -- Yes --> D[Register platform identity specs]
    C --> E{TEMPER_API_KEY configured?}
    D --> E
    E -- Yes --> F[Register credential specs]
    F --> G[Bootstrap operator credential]
    E -- No --> H[Continue without operator credential]
    G --> I[Bootstrap trusted issuer from environment]
    H --> I
    I --> J{Issuer configuration}
    J -- Complete --> K[Register trusted issuer]
    J -- Unset --> L[Leave JWT verification inactive]
    J -- Invalid or failed --> M[Fail startup before readiness]
    K --> N[Continue startup]
    L --> N

Loading

_{Reviews (2): Last reviewed commit: "chore(deps): repin temper to b0c79312 (m..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Native runtime platform
• Knowledge Base — Temperpaw service runtime

[rita-aga]

@greptile review

[rita-aga]

@greptile review