420 Names developer integration

Resolve against canonical Names420 state for security-sensitive use. Require unexpired records and treat optional profile/service links as references, not ambient authority.

For Identity display, enforce bilateral binding rather than trusting one-sided pointers.