Add policy-bound credential submission and native DLP audit proofs

tests/request-transfer-facts.test.mjs

@@ -28,7 +28,10 @@ test('privileged request gate routes upload audit through request facts without
  assert.match(source,/requestFactsForTransfer\(transfer\)/);
  assert.match(source,/audit\('upload\.authorized',null,new URL\(details\.url\)\.hostname,undefined,requestFacts\)/);
  assert.match(source,/audit\('upload\.block',transfer\.ruleId,new URL\(details\.url\)\.hostname,undefined,requestFacts\)/);
- assert.match(source,/core\.inspect\(requestBytes,policy\)/);
+ // Supplementary wiring check; actual receiver fixtures verify that ordinary
+ // secrets and confidential residual fields still cannot leave the browser.
+ assert.match(source,/scanBytes=claim\?claim\.residual:requestBytes/);
+ assert.match(source,/core\.inspect\(scanBytes,policy\)/);
  assert.equal(source.includes('sha256:transfer.sha256'),false);
 });