feat: add RFC 8785 canonicalization interop vectors and fix ADR-0003 (#322)

[SnehD]

Description

Resolves #322

Adds RFC 8785 canonicalization-boundary vectors from trace-spec for cross-implementation verification and resolves merge conflict in ADR-0003.

Motivation

The previous PR (#404) was closed because the canonicalizer implementation has already been merged upstream. This PR contains ONLY the valuable interop test vectors and the ADR documentation correction that were requested by the maintainer.

Cross-implementation canonicalization testing is critical for verifying RFC 8785 conformance without depending on implementation internals.

Changes

• ✅ Add four canonicalization-boundary vectors (signed by trace-spec)

  • 01-non-ascii-values.json - Tests literal UTF-8 output for BMP non-ASCII characters (e.g., "modèle", "机密")
  • 02-non-bmp-values.json - Tests literal UTF-8 output for non-BMP characters (e.g., 🤖, 🔒 emojis)
  • 03-utf16-key-order.json - Tests RFC 8785's UTF-16 code-unit based key sorting (catches naive UTF-8 sorters)
  • 04-utf16-key-order-nested.json - Tests recursive UTF-16 sorting at all nesting levels

• ✅ Add interop test runner (test_trace_canonicalization_boundary.py)

  • Black-box verification using EdDSA signatures from trace-spec
  • Signature fails if canonicalization is incorrect
  • Gracefully skips if vectors not yet fetched

• ✅ Add interop directory README

  • Explains purpose of vectors
  • Provides fetch instructions for trace-spec examples
  • Documents how to run tests

• ✅ Resolve merge conflict in ADR-0003

  • Add missing reference to Section 3.2.2 (composite policy sub-bundles)
  • Clarify that domain separation applies to all levels

Scope Restrictions (Maintained)

• ✅ ONLY python/tests/interop/ and docs/adr/0003-rfc9162-merkle-domain-separation.md modified
• ✅ _canonicalize.py untouched (implementation already merged)
• ✅ test_canonicalize.py untouched (existing tests preserved)
• ✅ No canonicalizer implementation changes
• ✅ No CI configuration changes
• ✅ No dependency updates

Testing

• ✅ All 4 interop vectors pass signature verification (test_canonicalize_matches_trace_spec_signature)
• ✅ All 47 existing canonicalize tests pass (no regressions)
• ✅ Total: 48 tests passed

$ pytest python/tests/interop/test_trace_canonicalization_boundary.py python/tests/test_canonicalize.py -v
============================== 48 passed in 1.11s ==============================

[github-actions]

Thanks for this, @SnehD. Closing it for now, and it is not about the change itself.

This repository asks first-time contributors to be vouched by a maintainer before opening a pull request. That is because agent-written contributions are easy to produce and expensive to review, and we would rather talk to you first than review something neither of us can explain.

To get vouched: open an issue saying what you want to change and why, in your own words. A maintainer will reply, and add you with /vouch. After that, reopen this pull request or open a new one.

See CONTRIBUTING.md for the detail.