420 Identity developer integration

Use Identity420 canonical reads for profile/issuer/credential decisions. Apply application-specific policy on top of protocol validity rather than turning every credential into automatic authorization.

For Names integration, require bilateral binding. Revalidate credentials when issuer, subject, expiry or revocation state may have changed.