fix(content-marking): establish presence of the required binding fields

[imran-siddique]

Closes #326.

verify_assertion() compared the duplicated binding fields with .get() equality. A comparison establishes that two reads agree, not that either exists, and two absences compare equal.

Reproduced at 0aefa1f, running @lywinged's six cases with record.hash recomputed over the modified bytes each time so every pair stays self-consistent:

before the fix                          after the fix
ACCEPTED                 subject absent on both sides        refused(ContentMarkingError)
ACCEPTED                 eat_profile absent on both sides    refused(ContentMarkingError)
ACCEPTED                 both fields absent on both sides    refused(ContentMarkingError)
refused(RecordMismatch)  assertion-only omission             refused(ContentMarkingError)
refused(RecordMismatch)  record-only omission                refused(RecordMismatch)
ACCEPTED                 valid pair                          ACCEPTED

The two single-side rows are what make the hole precisely mutual absence rather than something wider.

Why this layer has to establish its own shape

spec/content-marking-v1.md section 2 marks both fields required and section 6 says a conforming consumer checks both against the fetched record. verify_assertion() performs only the binding check and returns the parsed record before any Trust Record signature or schema verification, and a caller is allowed to run it on its own. Relying on a later verifier to reject the record is not available to it.

Which exception, and why it differs by side

• Assertion missing a required field: ContentMarkingError. A malformed assertion is the caller's own input. RecordMismatch means "the URL is serving something else" and would point the reader at whoever operates that server, which is the reasoning test_an_int_no_longer_reports_a_record_mismatch already pins in this file.
• Record missing a required field: RecordMismatch. It matched the declared hash, so that URL really is serving something that is not a conformant record.
• Two present values that disagree: unchanged.

The only behaviour change for input that was already refused is the class on an assertion-side omission, from RecordMismatch to its ContentMarkingError parent. No caller catching the documented contract loses anything, and one catching RecordMismatch specifically was being told the wrong party was at fault.

Verified in both directions

• With the fix: tests/test_content_marking.py 43 passed, repository 1437 passed.
• Against origin/main's content_marking.py: 7 of the new cases fail.
• The pair helper recomputes the hash. Without that every case would fail at the digest check and pass for the wrong reason, so the helper's docstring says so.
• The four repository-wide failures in test_generators_reproduce_fixtures.py and test_safe_integer_range.py are pre-existing Windows path-separator artifacts.

No overlap with #325, which touches build_assertion only.

Reported by @altrudev. Reproduced independently by @lywinged, whose six-case matrix and check against #325's head is what this PR's coverage is built from.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW