Use policy hash comparison instead of deep structural iteration in validatePoliciesSubset

[kronosapiens]

Context

SessionProvider.validatePoliciesSubset() (in src/session/provider.ts) iterates over every contract/method/message and does deep JSON.stringify comparisons to check whether stored policies are a superset of current policies. This runs on every probe() call to determine if a cached session is still valid.

Suggestion

The WASM layer already computes a merkle root from policies (via toWasmPolicies). Instead of the structural deep comparison, we could compare policy hashes directly — simpler, faster, and less fragile than relying on JSON.stringify ordering for domain/types equality.

The allowedPoliciesRoot field already exists on SessionRegistration but is never used for comparison.

Affected files

• packages/controller/src/session/provider.ts — browser provider
• packages/controller/src/node/provider.ts — node provider (same logic ported)

[gillen-pitchclick]

This issue has been inactive for 30+ days. It will be auto-closed in 7 days unless there is new activity.

Add the keep-open label to prevent auto-close.