Replace Java authenticator with native eSignet 2.0 BREG provider

[jeremi]

Replace the unused Java authenticator with a native Go BREG provider for eSignet v2.0.0-beta.1, pinned to df0d0e771dae16eb2597b8e5b5dc65e70baa7f86. This prepares the v0.3.0 candidate and removes the obsolete Maven, JAR, Spring, and custom KYC-token implementation.

Changes

• Keep provider logic in a standalone Go 1.26 module, with a small adapter and checked patches applied to exact upstream source and Thunder dependencies.
• Verify challenges before Mint or BREG traffic; use fixed governed lookups, pairwise HMAC subjects, expiring transaction-bound context, fresh consent, and explicit approved-claim selection.
• Preserve private-key JWT token acquisition, bounded caching and HTTP, cancellation, denial versus dependency failure, and sensitive-data redaction. Delegate signed and encrypted UserInfo to eSignet.
• Supply an explicitly enabled synthetic OTP verifier. Missing production verifier configuration fails startup.
• Add pinned amd64/arm64 candidate image builds, source metadata, verified dependency archive extraction, and adopter documentation.
• Backport Thunder's signing-algorithm fix and remove sensitive runtime keys and query strings from diagnostics.

Validation

• Go unit tests, race detection, static checks, and adapter tests against the exact patched upstream source passed.
• Regression coverage includes pre-consent nil/empty calls, restored/expired/mismatched context, stable pairwise subjects, claim filtering, Mint concurrency/expiry/rejection, malformed dependencies, cancellation, and redaction canaries.
• Real eSignet, Mint, and BREG protocol proof passed all 8 checks, including consent refusal, repeated login, signed UserInfo, encrypted UserInfo, and repeated requests. Browser integration passed 7 hosted-mode tests with 2 mock-only skips.
• Local amd64 and arm64 candidate OCI artifacts were built and their checksums and metadata verified.

Scope

This is BREG-first. Relay, production OTP, enrollment, wallet login, and identity assurance remain outside this candidate. The accompanying Solmara Lab PR supplies the runnable integration. Candidate artifacts have not been published and no hosted deployment was changed.

Companion Lab integration: registrystack/solmara-lab#40

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-09-09T14:50:46.924855Z	13290e9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e42174824

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".