net: party envelopes are bearer documents in the identity flow

[samlown]

Follow-up to #924, from review of the live flow: the audience-bound subject signatures required by the registry and verifier inboxes are redundant with the request token, which already carries the fresh origin+destination statement for every request.

Spec change (§2, §5.3, §6.2, §8.3): party envelopes in the registration and verification flows are bearer documents — the subject signs once, audience-free, and that same envelope registers, publishes at /who, goes to the verifier, and renews, with no per-hop signatures. The directed statements are the countersignatures (iss=<authority|verifier>, aud=<subject>). Each receiving role applies its own rule: registry → token + eligibility; verifier → the registry's countersignature; subject's own inbox → party envelopes whose subject is itself (the returns). Deferred who disclosures remain audience-bound (that aud is what marks them private), and document deliveries keep the signed aud requirement — the token cannot prevent cross-inbox replay of a captured document, the signed audience does.

Third-party submission of a published (public) envelope is at worst an unsolicited renewal: results only ever deliver to the subject's inbox, and endorsements are scoped by each client's trust list.

No code changes in net — VerifyEnvelope's audience search stays for documents. Companion PRs relax the registry and verifier inboxes: invopop/gobl.lookup#7 and invopop/gobl.kyb.sandbox#4.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.99%. Comparing base (210f7ae) to head (a224bd6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #925   +/-   ##
=======================================
  Coverage   94.99%   94.99%           
=======================================
  Files         327      327           
  Lines       17712    17732   +20     
=======================================
+ Hits        16825    16845   +20     
  Misses        547      547           
  Partials      340      340           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.