fix(developer-license): sign every Pro feature and no image digests

[Harol-Reina]

Summary

The free Tier 0.5 developer licence validated Invalid in Pro, so nobody evaluating Verbara saw any Pro feature.

• Feature bits: the issuer signed Features = 511 (the 9 bits that existed when it was written). Pro requires the Developer tier to carry the full canonical set (LicenseFeature.All, 12 bits = 4095). The bits are now listed by name in functions/api/developer-license/license-features.ts, mirroring Pro's LicenseFeature, and FEATURES_ALL is computed from that list. tests/unit/license-features.test.ts pins the 12 names, values and order.
• No image digests in the licence: AuthorizedImageDigests is no longer embedded. The field is omitted (not []): Pro serializes it WhenWritingNull, so an empty array breaks the signature. The release digest ledger (data/authorized-digests.json, loadRegistry) stays for the drift check; the unused 6-digest selection is removed.
• D1 audit row: features = 4095; authorized_image_digests takes its '[]' default.
• Docs: data/README.md, docs/operations/issuer-setup.md (Features: 4095, no digests), gates.yaml. Test stubs now match URLs by exact hostname.
• coverage-floor.json: lines_valid_min 300 → 290 (dead code removed; 296 lines measured; reason in _comment).

Proven end to end: a licence issued through the real onRequestPost (ephemeral test key) validates Valid in Pro's actual LicenseValidator (Features = All, no digests key); the previous code validates Invalid; a .lic with "AuthorizedImageDigests": [] added by hand validates Invalid.

Not fixed here (separate, pre-existing): a licensee containing +, & or non-ASCII characters still validates Invalid — Pro's canonical JSON escapes them (System.Text.Json default encoder) and JSON.stringify does not. The deployed Worker version cannot be checked from here.

Test plan

• npm run check, lint, test:i18n, validate:digests, npm test (91), build, validate:html, script suites, coverage floor + patch (100 %) + exclusion baseline
• mutations: dropping CsatRunner → 4 tests red; writing AuthorizedImageDigests: [] → 2 tests red
• end-to-end validation against Pro LicenseValidator (implementer and an independent verifier, separate harnesses)
• codeql-branch stamped d1e9e04b

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	verbara-website	d1e9e04	Commit Preview URL Branch Preview URL	Oct 03 2026, 11:39 PM