feat!: validate brand domains in signing authorization

[bokelley]

Summary

• add public PSL-backed brand-domain validation helpers
• reject non-registrable and IANA special-use names in production
• require an explicit, independent development-domain opt-in
• make the resolver brand_domain input match the bare BrandRef wire contract

Breaking change

BrandJsonAuthorizationResolver check and is_authorized now require brand_domain to be a bare dotted hostname. Callers that previously passed a URL must extract its hostname first.

BREAKING CHANGE: BrandJsonAuthorizationResolver brand_domain no longer accepts URL-form values.

Tests

• uv run ruff check
• uv run ruff format --check
• uv run pytest tests/test_etld.py tests/test_brand_authz.py -q

[aao-secretariat]

Ladon verdict: Approve

Approve — PSL-backed brand-domain validation added to signing authorization.

Checked:

• Change is additive and fails closed: production rejects development and IANA special-use names before any binding runs; the new dev-namespace clause is gated on allow_private_destinations; no fail-open path introduced.
• Well-covered by tests across invalid_syntax / not_registrable / special_use / dev-option / mDNS branches.
• No public-surface semver break, no forward-compat regression, no type-layering violation, no generated-code hand-edit, no credential-in-metadata issue, CI gates untouched.

Decision-table walk:

• Rows 1 (critical/high): no such findings.
• Row 2 (gated_paths): gated_paths is false — not triggered despite review_decision: REVIEW_REQUIRED.
• Row 3 (deleted high-risk file): all high-risk matches are (modified), none deleted.
• Rows 4/5 (medium findings): zero medium findings.
• Row 6: no prior decision.
• Row 7: no no-auto-approve team match.
• Row 8: fewer than three medium findings (zero).
• Row 9: approve.

The high_risk flag is set only because the diff touches src/adcp/signing/** (all modifications), but the reviewer found no medium-or-higher concerns, so the modifications are presumed safe.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean delta pass on PR #1139.

This change splits the overloaded allow_private_destinations flag into an independent allow_development_domains flag in brand_authz.py. The split is complete with no dangling references, fail-closed by default (default False), additive and non-breaking on the public surface, and fully test-covered (production-reject, private-only-reject, both-flags-authorize, malformed/URL/None-reject branches).

Checks:

• No critical/high findings (rows 1 satisfied — none).
• gated_paths is false, so row 2 does not apply despite review_decision REVIEW_REQUIRED.
• high_risk is true but all high_risk_reasons are (modified) with NO medium findings → rows 3, 4, 5 do not fire.
• Prior decision was approve, so sticky-escalation row 6 does not apply.
• No no-auto-approve team match (row 7 clear).
• Zero medium findings (row 8 clear).

Falls through to row 9 → approve.