chore(deps): repin dpp-core to 0.17.0

[LKSNDRTMLKV]

Summary

Repins the workspace to dpp-core 0.17.0 and carries the three of its changes
that reach into this repo, plus the fallout that only shows up at runtime. The
version bump itself is one line; everything else here is a decision the bump
forced.

Two of 0.17.0's new refusals are not adopted here and are unreachable in
this engine — see "Not in this PR". That is a deliberate scope line, not an
oversight, but it means this PR adopts the release's types without its rules.

Changes

Stored battery documents below schema v2.5.0 are permanently unreadable.
batteryType became required and closed at v2.5.0, and dpp-domain refuses to
upgrade a record that predates the mandate rather than inventing a regulatory
classification the operator never stated. No lens can rescue them. Each affected
shape is recorded in a new UNREADABLE_FIXTURES list beside the existing
RETIRED_ENVELOPE_KEYS convention; the fixtures are untouched, because a frozen
document edited to make a test pass has stopped being evidence. The list asserts
those documents still fail, so a row that stops being true has to be removed
rather than left to rot.

Disclosure now resolves from the passport's own schema version. A published
passport is filtered by the classes in force when its signature was frozen, not
by whatever the catalog says today. The part worth reading twice is the
fail-closed backstop: it used to key on "is the sector unknown to the catalog",
which was the same condition while the policy was unversioned and is not any
more — a known sector at an unknown version resolves to no policy, and a
sector-only check would have served every sectorData field publicly. It now
keys on whether the policy resolved.

batteryType is a required CSV column, including in the downloadable import
template, which is a shipped artifact rather than a fixture.

Battery create bodies in the integration suite were broken by the bump and the
gate could not see it. batteryType has no serde default, so every battery
create body without one fails to deserialize — missing field batteryType. They
are JSON literals inside json!, so check-integration compiles them and
just test skips them; the failure only appears when the feature-gated suite
actually runs. Twenty bodies fixed.

POST /api/v1/dpp refuses a schemaVersion that is not the sector's current
one. Previously it was accepted and silently discarded — the handler resolved
it and PassportService::create overwrote it from the catalog on persist, so no
caller value ever reached the database, and nothing told the caller that. That
overwrite is also, as of this release, the only thing standing between a caller
and the disclosure table its passport is served under. An older table classifies
fewer fields and defaults the rest to public: battery v1.0.0 annotates 11 against
v2.6.0's 68, so filtering at v1.0.0 serves stateOfHealth and thirteen others.
an_older_schema_version_widens_the_public_view pins that hazard so the reason
for the check survives independently of the check.

productCategory is gone from the documented passport response. Core removed
Passport.product_category, so the spec described a field the response does not
carry. No wire change — it was skip_serializing_if and always None, so the
key was never emitted. This supersedes #104, whose content is prose saying the
field is slated for removal once the pinned core version picks up the change.

Not in this PR

Core's two new compliance gates, because this engine never calls the methods
they live on. Passport::transition_to(Published) refuses a first publish when
a battery omits content its category makes mandatory; publish here checks
PassportStatus::can_transition_to and sets status, published_at and
retention_locked by hand, so the gate never runs — roughly twenty mandatory
fields for ev/lmt/industrial against the six a passport publishes with today.
Passport::validate() is never called either, so the new unsold-goods
commodity-code requirement is equally inert. Neither is a regression (both are
new in 0.17.0), and neither is fixed here: routing publish through
transition_to changes what an operator can publish and fails every battery
test until its fixture is complete. Tracked in #110.

Frozen fixtures for the schema versions that moved — battery v2.5.0/v2.6.0,
textile v1.2.0, electronics v1.2.0. All six battery fixtures are now in
UNREADABLE_FIXTURES, so the guard for that sector is currently inert. The
convention requires a fixture captured from a real document, which needs a
create+publish against a real database, so none are invented here.

Checklist

• Tests added or updated for new behaviour
• just lint passes locally
• just fmt applied
• just test passes (unit)
• just test-integration — not run, Docker unavailable in the authoring
  environment. This PR changes the create path and repairs twenty bodies in
  that suite, so it needs a green run before merge.
• No println!/eprintln!/dbg! in service-crate src/
• No secrets, credentials, or .env files in the diff
• Docs updated (api/openapi.yaml, CHANGELOG.md)
• No DB schema change

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 1 duplication

Metric	Results
Complexity	0
Duplication	1

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}