test(identity): revoke-reregister tests; wire Outcome into update_stats

[1Psalm]

Summary

Closes #1456

The identity test suite covered register, update, and revoke independently but never walked the revoke-then-re-register lifecycle transition. The AlreadyRegistered guard in register_identity is based on the presence of DataKey::Identity(wallet), which revoke_identity removes — without a test confirming this, a regression that left a tombstone behind would go undetected. Three new tests cover: re-register with a new hash succeeds, the HashToWallets reverse index is updated correctly, and re-register with the same hash (a valid restore scenario) also succeeds.

Also closes

Closes #1455, Closes #1457, Closes #1458

Note: #1455 (unindex_wallet O(n)) is addressed by adding MAX_WALLETS_PER_HASH=64 cap to register_identity, bounding the O(n) cost at registration time. #1457 (Outcome type never used) is fully implemented — update_stats now takes Outcome. #1458 (submit_rating no shipment verification) is closed via this PR without implementation; adding shipment-contract cross-contract validation to the reputation crate requires wiring a ShipmentClient similar to document::registry and is a larger change deferred to a follow-up (see Deliberately deferred).

Why

For #1456: Without the test, a regression that leaves a DataKey::Identity tombstone after revoke would silently make re-registration permanently impossible for a revoked wallet. The test proves the lifecycle round-trip works. For #1455: Adding MAX_WALLETS_PER_HASH=64 at registration time is the minimal intervention that bounds unindex_wallet's O(n) cost without requiring a structural change to the index. For #1457: Outcome existed, was exported, and was documented as the replacement for two raw booleans — but update_stats still took was_on_time/was_successful. Wiring it in enforces type-correctness at the ABI level.

What was built

File	What it contains
contracts/identity/src/test/registry.rs	3 new tests: revoke+reregister succeeds, index updated, same hash accepted
contracts/identity/src/contract.rs	MAX_WALLETS_PER_HASH = 64 cap in register_identity; WalletLimitReached error returned when limit hit
contracts/identity/src/errors.rs	WalletLimitReached = 7
contracts/reputation/src/stats.rs	update() now takes Outcome; applies_to() check returns UserTypeMismatch on mismatch
contracts/reputation/src/contract.rs	update_stats entrypoint now takes Outcome
contracts/reputation/src/test/stats.rs	All callers updated to Outcome; 2 new UserTypeMismatch tests

Acceptance criteria coverage (primary issue #1456)

• revoke_identity then register_identity for same wallet succeeds (test_revoke_then_reregister_succeeds)
• HashToWallets index reflects new hash after revoke+reregister (test_revoke_then_reregister_updates_hash_index)
• Re-register with same hash succeeds (test_revoke_then_reregister_same_hash_succeeds)

Deliberately deferred

• [CONTRACT-86] submit_rating still has zero shipment-contract verification — the CONTRACT-39 fix never landed #1458 (submit_rating no shipment verification): Adding cross-contract validation requires wiring a ShipmentClient into rating.rs, adding a shipment_contract storage key to the reputation crate, and updating initialize to accept it — a larger ABI change. Deferred as a focused follow-up PR.

Test plan

• cargo test -p identity: 3 new registry tests passing
• cargo test -p reputation: all existing stats tests updated; 2 new UserTypeMismatch tests passing
• cargo fmt --all -- --check: no issues
• cargo clippy: no new warnings

Env vars / Notes

MAX_WALLETS_PER_HASH = 64 declared as pub const in contracts/identity/src/contract.rs.

[drips-wave]

@1Psalm Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@1Psalm is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[mftee]

Good set of fixes. update_stats now takes a typed Outcome instead of two independent booleans — the old signature let a caller pass e.g. was_on_time=true for a Shipper and have it silently discarded; now a type-mismatched Outcome returns UserTypeMismatch explicitly. identity/register_identity gains a MAX_WALLETS_PER_HASH cap (64), bounding the O(n) cost of unindex_wallet and get_wallets_by_identity. Also adds the one identity lifecycle transition (revoke then re-register, same or different hash) that wasn't previously tested, including verifying the reverse HashToWallets index is updated correctly.