feat(insight): verify OracleSafetyCheck v3 and isolate synthetic samples

[Zk-nd3r]

What changed

• Added exact OracleSafetyCheck v2/v3 EIP-712 dispatch. V3 is fixed to domain version 3, 27 ordered fields, and signed requiredSourceGroupCount = 2.
• Kept the v2 compatibility API v2-only and the retired v2 alias historical-only.
• Routed the public sample path through the sample-role verifier. Valid samples return UNKNOWN_BLOCKED / SYNTHETIC_SAMPLE_ONLY; malformed or tampered samples fail closed. No observation, replay commit, binding, or action is created.
• Made raw-byte source hashes stable across Windows and Linux checkouts.

Verified

Exact Node v22.22.2 on a fresh checkout of 5329d33390b85259194e29010f41201f5fa9da61:

• npm run test:offline — pass, including packed install and MCP handshake
• npm run test:insight-receiver — pass, 68/68 raw and canonical hashes
• npm run test:insight-live-sample — pass at 2026-09-03T20:32:12Z; two GETs, no credentials or writes
• npm run audit:release — 0 vulnerabilities
• package dry run — 148 files, 130596 bytes

Primary public evidence:

• Oracle Insight: https://www.oracleinsight.xyz/
• Registry: https://www.oracleinsight.xyz/.well-known/oracle-keys.json
• Signed registry status: https://www.oracleinsight.xyz/.well-known/oracle-registry-status.json
• Live sample: https://www.oracleinsight.xyz/api/v1/safety/attestation/sample

Mutable registry bytes do not admit a signer or trust head. Private correspondence is excluded. This is not a release, deployment, customer, acceptance, adoption, partnership, or endorsement claim.