refactor: carve verification core into wsc-verify-core (wasm-buildable)

[avrabe]

Summary

Splits the network-free verification core out of wsc into a new workspace crate wsc-verify-core so it builds for wasm32-* with plain cargo. Closes the blocker recorded on #128.

wsc transitively required ring (via rustls/ureq/rcgen/rustls-webpki/x509-parser) — ring does not build for wasm32-* with the default LLVM toolchain. The classic verification path itself (PublicKey::verify, verify_multi, the WASM module parser, the signature-section parser) needs none of those; they belong to the keyless/Sigstore/provisioning machinery. The carve separates the two so MC/DC coverage tools (witness) and any future wasm consumer can instrument the verification core directly with cargo build --target wasm32-*.

What moved

Into src/verify-core/:

• wasm_module/ — varint, component, mod
• signature/{hash,info,keys,matrix,multi,sig_sections,simple}.rs
• split.rs (inherent impl Module {…} methods)
• secure_file.rs (key file IO — needed by KeyPair::from_file)
• A minimal CoreError (avoids the From<X509Error> for WSError orphan-rule trap)

wsc:

• depends on wsc-verify-core
• re-exports its public API (wsc::PublicKey, wsc::Module, wsc::SIGNATURE_*, etc. — unchanged)
• has From<CoreError> for WSError so the boundary is transparent under ?
• keeps signature/keyless/, composition/, airgapped/, sct/, provisioning/, http/, runtime/ — the layers that need the heavy deps

Verification

Local checks (this branch, this commit):

Check	Result
cargo build --workspace	clean
cargo test --workspace --lib	772 passed, 0 failed (588 wsc + 166 verify-core + 18 attestation)
cargo build -p wsc-verify-core --target wasm32-wasip2	clean — no ring
cargo build -p wsc-verify-core --target wasm32-unknown-unknown	clean — no ring
cargo tree -p wsc-verify-core -i ring	"package not found"
same for rustls, ureq, rcgen, rustls-webpki, x509-parser	"package not found"

A clean-room verification subagent independently re-validated all 8 of the above against the actual branch state with no access to my reasoning — every claim CONFIRMED.

Bazel

• New src/verify-core/BUILD.bazel (rust_library with only the 7 lightweight deps)
• src/lib/BUILD.bazel adds //src/verify-core:wsc-verify-core as a dep

Local Bazel was blocked by the sandbox (no Nix in PATH, network unreachable for the wizer fetch). CI will validate end-to-end.

Why this matters beyond #128

The verification core no longer carries the keyless / TLS / X.509 dependency closure. That's a real reduction in the audit and supply-chain surface of the actual verification code — useful in itself, separate from the witness MC/DC goal it unblocks.

Test plan

• cargo build --workspace, cargo test --workspace --lib
• cargo build -p wsc-verify-core --target wasm32-wasip2
• cargo build -p wsc-verify-core --target wasm32-unknown-unknown
• Clean-room verifier subagent confirmed 8/8 claims
• CI green (full Bazel + workspace matrix)
• Follow-up: witness MC/DC harness against the new crate (MC/DC coverage for verification functions via witness (WASM harness) #128)

🤖 Generated with Claude Code