fix: restore the constraints and toolchain bump lost in a force-push

[SupremaLex]

These constraints were already reviewed and merged. I lost them.

xgreenx wrote them in review of #1 and they were merged into that branch as #4.
I then rebased feat/ceremony-circuits onto main and force-pushed, which
discarded the merge commit carrying them — --force-with-lease allowed it
because my own git fetch had already advanced the tracking ref. #1 therefore
landed on main without them, and the same push dropped #5's toolchain bump.

This restores the patch verbatim onto the renamed path.

What it puts back

REQ-COMMON-19 requires a string claim's match to cover the closing quote
and the following structural byte. Only email_verified and exp asserted
their trailing byte; email, nonce, sub, iss and aud stopped at the
closing quote, so a claim-shaped substring inside a longer signed string value
would have matched — JSON escaping of attacker-typed content was the only thing
in the way. Every claim now ends at , or } through one shared
assert_structural(), and the §9 bounds grow by one byte so the trailing byte
itself must lie inside the authenticated payload length (REQ-COMMON-19B) rather
than in prover-controlled zero padding.

REQ-COMMON-19D pins integers to canonical 0|[1-9][0-9]*. The exp
digit-run check accepted leading zeros, so a leading-zero rendering was a second
signed encoding of the same u64. A multi-digit exp may no longer start with
0; the lone 0 stays legal.

Independent check that the restore is byte-exact

xgreenx's original commit predicted the key would become 0x1596b429…2af7a27c.
Rebuilt here under the same pinned toolchain:

Circuit	vk_hash
bearer-link	0x02bbc194f5160b0918f408d0f67445b8882e86d76e58b3465637cb6bcb26818e (unchanged)
oidc-google	0x1596b4295a9471df3d620bb3a94c970dd695a0617117ed4d0c9190ad2af7a27c

It matches. Tests go 3 → 7.

Second commit: the toolchain bump

Wondertan's bb 5.2.0 / nargo 1.0.0-beta.25 bump (originally #5) went the same
way, so it is restored here too rather than after the release — it moves every
key, and releasing without it means re-cutting.

Rebuilt under the restored pins, with x-token already gone:

Circuit	vk_hash
bearer-link	0x1d161afb536683d31a3e426db0feaa30de8be89cc45510579f361266c20e078f
oidc-google	0x1b50bbf6d8ea6efc7ecc2547c25b285511704a10d9247466e84045095d9c3f77

These are the keys a v0.3.0 tag would ship. Downstream verifiers regenerate
from them, so libid-contracts rolls its committed Solidity with the same tag.

bearer_link 12 tests, oidc_google 7, nargo fmt --check clean on both
under beta.25.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01MWEkr8qPxq8dUc4DP1hhzA