[samgbafa]

New Policy/v3 registrations must now name their share key and its digest. POST /policy/v3/policies answers 400 for a content source without encryptionKeyPath, and for any source (mutable or immutable) without encryptedSymmetricKeyDigestHex. Nothing is stored on a refusal. The check runs only when a registration is stored, for every credential requirement: a replay of an already-stored registration still answers 200, and stored registrations validate and open as before (registration_projections is unchanged by this PR).

Tests (policy_v3/unbound_source_tests.rs, SQLite and PostgreSQL):

• each refused shape is refused and leaves the registration, root and delegation rows unchanged, including a non-email credential requirement and a path-bound source without its digest (answered content-source-invalid by the validation merged in PolicyV3: bind Share decrypt to registered named keys #481, ahead of this check);
• a stored registration without a key path still challenges, mints, reads and decrypts (well-formed body), and its replay is accepted;
• an exact path-bound registration (share/<shareId>, with its digest, mutable or immutable) is stored and admits decrypt on that leaf only.

Existing-test setup changes (no assertion changed; all under the ruling below):

• Registrations without encryptionKeyPath that existing tests make through Harness::register_with are stored as already-stored rows (Harness::store_registration_on); path-bound ones still go through the route. This covers the revocation and run_policy_v2_flow tests and PolicyV3: bind Share decrypt to registered named keys #481's legacy decrypt fixtures.
• The PostgreSQL lock probe posts a path-bound registration so it still reaches the handler's transaction.
• The three run_policy_v2_flow tests box their future (the merged tree overflowed the 2 MiB test stack).
• ShareDecrypt in named_keys_gate_tests.rs becomes pub(super) (visibility only) so the legacy decrypt test can reuse it.

test-ruling: TC-2242

Details: TC-2242

[samgbafa]

APPROVE: see TC-2242 (reviewed exact head 8302ed2)

[samgbafa]

APPROVE: see TC-2242 (reviewed exact head 3d80b4a)

[samgbafa]

APPROVE: see TC-2242 (reviewed exact head bdbdc6d)