chore(deps)!: repin dpp-core to 0.22.0

[LKSNDRTMLKV]

Summary

Repins dpp-core from 0.21.0 to 0.22.0, and lands the first slice of #446 with it. The slice has to ship in the same release: core's publish gate now refuses a passport whose personal-data-marked field has a value and no statement, and without this there is no way to write the statement.

The compile breaks were found by bumping the pin and letting cargo check list them. The registry port is the part that is more than a rename.

Related issue

Refs #446 (the check on every write and personalData are done; the erasable store and the erase route are not). Unblocks #326.

Changes

Keys, DID documents and signing (odal-node/dpp-core#376, odal-node/dpp-core#374)

• A verification method is named by its key's own thumbprint, and every signature's kid is the absolute URL of the method that made it. resolve_verification_key replaces extract_key_by_fingerprint and extract_primary_public_key in the resolver, the vault's dossier verification, the CLI snapshot check and the credential middleware. A token that names no key is refused rather than checked against a default.
• The identity service names the key through one AppState::verification_method_url, used by sign and by rotate_key, whose new_key_id was still …#key-1.
• The credential middleware goes through core's authenticate_access_credential, which also requires typ: vc+jwt and cty: vc. A new test pins that the issuer's own signature over a credential-shaped payload does not pass unless it is typed.
• Signed ruleset bundles name their key by thumbprint.

The EU registry adapter (odal-node/dpp-core#98)

• register returns the correlation identifier; check_submission finds the submission's task on the registry's dashboard (TASKS_PATH, then TASK_RESULT_PATH_TEMPLATE) and reports Registered, Refused, Processing or Unrecognised; check_status and notify_transfer take the registration identifier, escaped into one path segment.
• The drain polls a submitted row by its correlation identifier. A replayed idempotency key carries no handle, so that row is left submitted and is not polled, rather than polled by an invented id.
• An item is registered under its carrier serial, and the batch is linked on the level. It used to be named by the passport's own id.
• The deactivated drain outcome is gone: a submission's ruling is not a record's state.
• The transfer drain only reads registry_id from a registered row.

Personal data (#446, odal-node/dpp-core#261)

• check_personal_data runs on create, on each draft update and on the draft an amendment builds, and answers 422 naming the field. personalData is accepted on create, patchable, served back on the authenticated read, and in the OpenAPI.
• The create handler answered every service error as 500. It now answers a validation error as 422, as PUT already did; the new smoke test caught it.
• The textile (1.4.0) and battery (2.8.0) stored-document fixtures are captured from the real create and publish path.

Battery rules (odal-node/dpp-core#389)

• co2ePerUnitKg is optional, and it and the four recycled-content shares are not applicable to EV, LMT and industrial batteries. The import template, the demo passports and the demo dossier drop them, and the counts in the API description are now 41, 40 and 33.

Fixtures: status_purpose on credential statuses, personal_data on passport literals, and the demo dossiers regenerated for the new key naming.

Things to know

• Tokens signed before the upgrade no longer verify. That is core's change and it is in the CHANGELOG. Nothing here migrates them.
• registry_id on the outbox row holds the correlation identifier while the row is submitted and the registration identifier once registered. It avoids a migration; a separate column would be cleaner, and I'd rather decide that on its own.
• The registry's wire is not published. The POST reply is read as core's SubmissionReceipt, and the dashboard routes and their field names are the ones core records as observed on 2026-10-14. The task is found by paging the list, because no route takes a correlation identifier. This is tested against a mock built from those names, not against the registry.
• /dpp/validate (the dry run) does not report personal-data findings yet. It runs the request checks only; the new check is at the write.
• The demo CSV datasets under ops/demo/datasets/ still carry co2ePerUnitKg and the recycled-content columns. They import, since the columns are optional, and nothing gates them.

Checklist

• Tests added or updated for new behaviour
• just lint and just lint-integration pass locally
• just fmt applied
• just test passes (unit)
• The Docker suites this touches pass locally: registry_outbox, the new personal-data smoke test, audience_read_route, continuity_snapshot, passport_doc_compat
• No println!/eprintln!/dbg! in service-crate src/
• No secrets, credentials, or .env files in the diff
• Docs updated: OpenAPI, CHANGELOG, runbook
• just openapi-check passes
• just check ends in audit, which fails the same way on main (the wasmtime advisories published 14 October, fixed in 49.0.3, and the yanked zip 8.6.0). Every other step passes.