zeekay a46eba450e pqrns: decomplect — consume luxfi/zwing for hybrid identity ...

pqrns/pkg/identity now owns only the PQ-RNS wire constants (size
totals, IdentityKind enum, fingerprint shape) and the PQ-RNS-specific
domain-separation context strings. Identity keys themselves come from
zwing.Identity / zwing.IdentityPublic — same canonical hybrid
identity used by Z-Wing on TCP/IP. One signing surface for the whole
Lux stack.

Helpers:
  identity.Fingerprint(*zwing.IdentityPublic) [16]byte
                      RNS-shape SHA-256-prefix fingerprint over the
                      zwing canonical identity-blob bytes.
  identity.X25519PubBytes(*zwing.XWingPublicKey) []byte
                      32-byte X25519 leg for native-RNS addressing.
  identity.X25519PubFromBytes(b) (*ecdh.PublicKey, error)
                      parse a raw X25519 pub.

E2E tests pass:
  TestSignAndVerifyHybrid   sign + verify via zwing
  TestSignAndVerifyHybrid   wrong context refuses
  TestSignAndVerifyHybrid   tampered digest refuses
  TestFingerprintStable     deterministic
  TestFingerprintsDiffer    no collision

Example: `go run ./_examples/basic` — generates two zwing identities,
prints fingerprints, signs+verifies under PQRNS-IDENTITY-SIG-v1.

2026-05-12 20:34:47 -07:00

..

basic

pqrns: decomplect — consume luxfi/zwing for hybrid identity

2026-05-12 20:34:47 -07:00