feat(backup): guard legacy file removal by checksum (WIDC-217)

[murph]

Requestor/Issue: WIDC-217

Description/Why:
Face PCP migration moves an authenticated legacy package into identity-scoped storage before backup sync. Removing its old backup entry must not discard a different package registered at the same legacy path in the meantime.

Changes:

• Add internal BackupFileChange::RemoveIfChecksumMatches to the batch implementation landed in feat: batch backup file changes #440. Removal requires the expected designator and recorded BLAKE3 checksum; an absent entry is a retry-safe no-op.
• Reject the whole batch on a mismatch, without uploading or saving the candidate manifest. The old local file need not exist.
• Follow the existing Remove path normalization and case-sensitive matching. Hexadecimal checksum casing does not change the comparison.
• Test Put plus conditional legacy removal in one upload, preservation of another identity's complete manifest entry, retry without another upload, and rollback on checksum/designator mismatch.

Base / integration:
Targets main directly after #440. #451 is now additional batch tests/documentation, not a prerequisite.

This PR adds no public or UniFFI API. The change is intentionally internal until the public sync interface and native caller adoption described in #443 are implemented; the new variant has a narrowly scoped dead-code allowance for that interval. The intended Face flow submits Put for the scoped package and conditional removal for its legacy receipt in the same sync. Put already refreshes existing checksums, so remove/store pairs are unnecessary.

Consumer work: https://github.com/worldcoin/oxide/pull/1199, https://github.com/worldcoin/wld-android/pull/8681, and https://github.com/worldcoin/world-app-ios/pull/7983. Their draft adapters still target the earlier exported batch API and must be aligned with the public sync interface before building or releasing them.

Validation:

• 187 backup tests passed, 1 external integration test ignored.
• Both conditional-removal regressions passed after strengthening the preservation/error assertions.
• Strict workspace Clippy (--all-targets --all-features -- -D warnings), formatting, and whitespace checks passed.
• Previous remote CI passed Rust tests, Kotlin bindings, Swift builds, and Swift binding tests on the older revision; CI must rerun for this revision. No new native API is introduced here.

Remaining CI dependency:
The prior advisory check failed on rustls 0.23.27 / RUSTSEC-2026-0285, which is also in the current main lockfile. Its dependency update remains separate from this focused behavior change. The PR title now follows the repository's conventional-commit format.

Limits:
This checks the registered backup checksum, not concurrent local filesystem writes or package identity by itself. The caller must authenticate the original package before retaining its checksum receipt and keep source files stable during sync. As with #440, an ambiguous upload response or failed local manifest save can leave the server ahead; refresh that state before retrying.

---

Note

Medium Risk
Changes backup manifest mutation semantics on a security-sensitive path (conditional deletes during sync); behavior is guarded by checksum/designator checks and batch rollback, but incorrect caller checksums could block migration or leave stale entries.

Overview
Adds an internal batch manifest operation RemoveIfChecksumMatches so face PCP migration can drop a legacy backup entry only when it still matches the expected designator and BLAKE3 checksum—avoiding removal if another package took over the same path.

Behavior differs from Remove: a missing manifest entry is a retry-safe no-op (e.g. after a prior successful sync); designator or checksum mismatch fails the whole batch with no remote upload or local manifest write. Path handling matches Remove; checksum hex comparison is case-insensitive. The variant is internal (dead-code allowed until public sync callers adopt it).

New integration tests cover Put + conditional legacy removal in one sync, preserving another face entry, idempotent retry without a second upload, and rollback when designator or checksum does not match.

^{Reviewed by Cursor Bugbot for commit 52b71c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T00:46:08.339152Z	52b71c5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.