fix: use proper COSE_Sign1 in identity assertion test + add validation checking

[marmarko]

Summary

The IdentityAssertion.spec.ts test had two issues that masked a broken identity assertion signing protocol.

Issue 1: Raw signature instead of COSE_Sign1

The TestCawgSigner credential holder callback returned a raw DER signature:

// Before (broken)
sign = async (payload) => {
  const cborBytes = Buffer.from(encode(payload));
  return this.manifestSigner.sign(cborBytes); // raw DER
};

But sig_type: "cawg.x509.cose" requires the signature field in the identity assertion to be a complete COSE_Sign1 envelope (RFC 9052). The verifier calls CoseSign1::from_tagged_slice() on this field and fails with "extraneous data in CBOR input" on raw DER bytes.

Fix

New CoseCawgSigner class that builds a proper COSE_Sign1:

1. CBOR-encode SignerPayload → detached payload
2. Protected header { 1: -7 } (ES256) as CBOR bstr
3. Build Sig_structure = ["Signature1", protected, b"", payload] per RFC 9052 §4.4
4. Sign CBOR(Sig_structure) with IEEE P1363 format
5. Return CBOR(Tag(18, [protected, {}, nil, signature]))

Important: byte strings must be Uint8Array, not Buffer. The cbor2 library unwraps Buffer content (treating it as pre-encoded CBOR) instead of encoding it as a raw bstr, which causes "got map, expected bstr" parse errors.

Issue 2: No validation checking

The test only verified that Reader.fromAsset() didn't throw — it never inspected validation_status. This masked the claimSignature.mismatch error that occurred on every run.

Fix

Added assertions for:

• cawg.identity assertion is present in the signed manifest
• Zero integrity errors in validation_status (trust warnings from self-signed certs are expected and filtered)

Dependencies

This test also requires the save_to_stream JUMBF regeneration fix in c2pa-rs (see contentauth/c2pa-rs#1944) to pass. Without that fix, dynamic assertions produce stale JUMBF → claimSignature.mismatch.

References

• Issue: IdentityAssertionSigner produces claimSignature.mismatch on every signed manifest #51
• c2pa-rs fix: fix: regenerate JUMBF after dynamic assertions in save_to_stream c2pa-rs#1944