refactor(truapi)!: move product accounts behind account holders

[pgherveou]

This draft holds the account-holder work as ten commits on main. Each commit builds and passes the Rust workspace checks on its own and is meant to become its own pull request, landed in order.

1. refactor(truapi): sign personhood through PersonhoodSigner: Statement Store, Bulletin and PGAS allocation take a PersonhoodSigner and the collections to scan instead of raw personhood entropy. No behavior change.
2. refactor(truapi): split ProductRuntimeHost into ProductConnection and HostSession: connection state (product, adapters, permissions, channels) lives in ProductConnection, and login, logout and identity in HostSession. No behavior change.
3. refactor(truapi): building blocks for account holders: RegistryUpdate for ring-VRF registry writes, TestResourceControls, and a narrower product_manifest. An unchanged registry snapshot is no longer rewritten.
4. fix(truapi)!: account fixes ahead of account holders: a paired VRF request never reuses a local AutoSigning grant, a refused local allocation returns Rejected outcomes as RFC 0010 defines, and Bulletin checks the authorization size before submitting.
5. refactor(truapi): SSO session and responder services: SsoRequestService owns the paired session and its outbound channel, and SsoResponderService the phone's handshake, serve loop and duplicate detection. No behavior change.
6. feat(truapi): one ProductConsent for account access: account-access decisions, review-skip rules, Allow once and one prompt at a time live in one place per runtime.
7. refactor(truapi): one HostGrantStore for kept grants: one store for kept grants on both hosts. A product reset bumps only the grant revision, so other products' work continues.
8. refactor(truapi): move wallet code into its account-holder modules: the phone's wallet code moves unchanged into signing_host/wallet_account_holder/, still as impl SigningHost, so the next commit shows its changes as edits. No behavior change.
9. refactor(truapi)!: account holders behind HostAccounts: HostAccounts<H> over an AccountHolder (the wallet on a signing host, an SSO client on a paired host) replaces ProductAuthority. Native wallets open one SSO service per peer with openSsoService.
10. feat(truapi)!: persist native allowance keys: native allowance keys survive restarts in protected platform storage, and iOS moves secret core values saved before this version into the Keychain.

Design: Host account holder architecture.

Validation per commit: Rust workspace build, fmt, clippy -D warnings, wasm32 checks, rustdoc and tests (locally only the macOS-only managed_scripts_use_their_project_directory_when_selected_explicitly fails). UniFFI bindings regenerate and the JS host tests pass for commits 9 and 10, and the iOS app builds for commit 10. Android checks did not run locally.

Supersedes #1303, #1305 and #1306.

[github-actions]

Bundle size report

Compared with main at e92f330.

	Raw	Gzip	Brotli
truapi-host	7.97 MiB (+84.5 KiB, +1.0%)	5.69 MiB (+30.3 KiB, +0.5%)	5.41 MiB (+21.7 KiB, +0.4%)
truapi-provider	4.03 MiB	1.27 MiB	960.1 KiB
truapi	6.30 MiB	891.5 KiB	729.9 KiB
Total	18.31 MiB (+84.5 KiB, +0.5%)	7.83 MiB (+30.3 KiB, +0.4%)	7.06 MiB (+21.7 KiB, +0.3%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.86 MiB (+83.9 KiB, +2.9%)	1022.6 KiB (+30.2 KiB, +3.0%)	768.9 KiB (+21.6 KiB, +2.9%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.4 KiB

Changed files (4)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.86 MiB (+83.9 KiB, +2.9%)	1022.6 KiB (+30.2 KiB, +3.0%)	768.9 KiB (+21.6 KiB, +2.9%)
truapi-host/generated/host-callbacks.js	11.2 KiB (+428 B, +3.9%)	3.6 KiB (+111 B, +3.1%)	3.0 KiB (+107 B, +3.6%)
truapi-host/generated/host-callbacks-adapter.js	7.2 KiB (+122 B, +1.7%)	1.6 KiB (+18 B, +1.1%)	1.4 KiB (+20 B, +1.4%)
truapi-host/generated/worker-callbacks.js	7.4 KiB (+101 B, +1.4%)	1.5 KiB (+18 B, +1.2%)	1.2 KiB (+16 B, +1.3%)

_{Commit: 0b41a0b}

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-14, a release may fail

_{Commit 0b41a0bd · run log}

[github-actions]

This pull request touches an app, which is not built by default. Add a label for each build you want:

• iOS simulator build, ios-simulator-build: builds the iOS app, runs its tests and attaches a build for the iOS Simulator on a Mac.
• iOS device build, ios-device-build: attaches a signed build that installs on a registered iPhone or iPad.
• Android build, android-device-build: attaches an APK that installs on an Android phone or an emulator.

Each starts as soon as it is added and follows the branch from then on.