conformance: align TR-ENV, TR-APR, TR-TXN and TR-SIG with §3.2.2 integer-by-value and safe-integer bounds (#516)

[drk-ram]

What this changes

Closes #516

Aligns the conformance suite (conformance/src/trace_tests/modules/) and its module documentation with spec/trace-v0.2.md §3.2.2 ("What counts as an integer"), agentrust_trace.sign, and trust-record-verify:

• conformance/src/trace_tests/modules/tr_env.py (TR-ENV-002): Decides iat by mathematical integer value within [1700000000, 9007199254740991], accepting whole-valued floats (1785000000.0, 1.785e9) and rejecting booleans, fractional floats (1785000000.5), non-finite floats, and values outside the RFC 8785 safe-integer range (9007199254740992, 1.0e21).
• conformance/src/trace_tests/modules/tr_apr.py (TR-APR-004) & conformance/docs/modules/tr-apr.md: Decides appraisal.timestamp by mathematical integer value within [-9007199254740991, 9007199254740991] before checking the future skew window, and updates the TR-APR-004 table row in conformance/docs/modules/tr-apr.md to distinguish whole-valued floats from fractional numbers and out-of-range values (Implementation findings from the Go verifier (#444): 26 items #448 item 24).
• conformance/src/trace_tests/modules/tr_txn.py (TR-TXN-002): Decides tool_transcript.call_count by mathematical integer value within [0, 9007199254740991].
• conformance/src/trace_tests/modules/tr_sig.py (_canonical_json / _canonical_body): Walks containers before rfc8785.dumps(d) to raise rfc8785.IntegerDomainError on whole-valued floats outside [-9007199254740991, 9007199254740991] (9007199254740992.0, 1.0e+21) and catches RecursionError in _canonical_body, matching agentrust_trace.sign._canonical_bytes.

Contributor: Raghuvar Durga (@drk-ram)

Cold-reader review noted that while test_tr_txn.py pinned both inclusive endpoints (0 / 0.0 / -0.0 and 9007199254740991 / 9007199254740991.0), test_tr_env.py and test_tr_apr.py did not pin the inclusive boundary values 1_700_000_000 / 1_700_000_000.0 (with 1_699_999_999 / 1_699_999_999.0 just below) and 9007199254740991 / 9007199254740991.0 (verifying that the upper safe-integer bound passes the range check and reaches the future-timestamp check). Added test_iat_at_safe_integer_upper_bound_reaches_future_check, _IAT_MIN boundary cases in test_tr_env.py, and test_a_timestamp_at_safe_integer_upper_bound_reaches_future_check in test_tr_apr.py.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

spec/trace-v0.2.md §3.2.2 ("What counts as an integer"), enforced in conformance/src/trace_tests/modules/ (TR-ENV-002, TR-APR-004, TR-TXN-002, TR-SIG-001, TR-SIG-005).

Tests for a fix

• conformance/tests/unit/test_tr_env.py: test_iat_whole_float_passes, test_iat_at_safe_integer_upper_bound_reaches_future_check, test_iat_non_integer_or_outside_safe_integer_range_fails
• conformance/tests/unit/test_tr_apr.py: test_a_whole_float_or_in_range_timestamp_passes, test_a_timestamp_outside_the_safe_integer_range_fails, test_a_timestamp_at_safe_integer_upper_bound_reaches_future_check
• conformance/tests/unit/test_tr_txn.py: test_whole_float_and_safe_bound_call_counts_are_valid, test_fractional_or_out_of_safe_range_call_count_fails
• conformance/tests/unit/test_tr_sig.py: test_whole_float_past_safe_integer_range_is_refused_in_canonicalization, test_whole_float_inside_safe_integer_range_canonicalizes_by_value, test_deeply_nested_record_fails_closed_without_raising, test_number_spelling_vectors_match_expected_conformance_verdicts

Validation commands run:

• python tools/check_dashes.py -> passed (no dashes outside examples/, spec/trace-v0.1.md)
• python -m pytest conformance/tests -q -> passed (761 passed, 5 xpassed)
• python -m pytest tests/test_integer_by_value.py -q -> passed (158 passed)

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[imran-siddique]

Checked together with the rest of this set (#518 to #521): all four merge cleanly onto main in sequence, and the combined tree passes everything main passes, in both the root suite and the conformance suite.