feat: extract Slice 8 asset capability base

[wizzoapp]

Summary

Extract the smallest coherent Slice 8 prerequisite from the conflicting #208 branch so relay Slices A/B/C and the final #208 rebase can build on a landable main commit.

Binding design: /home/adam/.openclaw/reports/app-origin-asset-relay-design-2026-07-21.md
Parent threat model: /home/adam/.openclaw/reports/data-segregation-design-2026-07-17.md §2

This base adds:

• same-origin-relay-v1 capability negotiation and AssetClientUpgradeRequiredError
• the new-server/old-client fail-closed contract: no unbound private URL is returned
• audience-bound asset claim schemas/codecs with legacy claims decoding as private and unbound
• asset URLs keyed to the issuing auth session, with masking 404 for missing or mismatched proof
• surface binding as a required per-client mode: web is explicitly none (bearer/DPoP-safe <img> on the pre-existing non-relay path); native is explicitly native-header-or-cookie

The asset URL contains only a keyed binding identifier, never the auth session id or proof. Asset responses are no-store. The optional mobile WebView cookie is host-only, HttpOnly, SameSite=Lax, and path-scoped to /api/assets/relay.

Supersedes #229

#229 reached its per-PR review allowance (2 reviews/day) before landing. This is the same wizzo/dseg-s8-prereq-base branch, recreated fresh per the starvation recipe so the corrected diff gets a fresh review. Round-2 findings on #229 are all fixed class-wide in HEAD 226cc90a8:

• P1 relay-credential gate now keys on the client's surface-binding mode (web=none, native=header/cookie), not connection-level credentialing — web assets resolve 200 on the non-relay path.
• P2 opaque/malformed Origin now parses to null and follows the non-HTTPS cookie path (303 + non-Secure cookie), no new URL() 500.
• P2 force-cache restricted to local cached-file sources; credentialed RN preview sources use reload.

Verification

• vp run test — full workspace suite passed (server: 2,507 passed/22 skipped)
• focused 148 contract/client/server unit + integration tests passed; vp check, vp run typecheck green
• integration: web omits capability and fetches issued /api/assets/ 200 with no cookie/header; native advertises, gets /api/assets/relay/, rejects missing proof, succeeds with header/cookie; old client receives AssetClientUpgradeRequiredError; opaque/malformed Origin → 303 + cookie without Secure
• factory pre-commit gate passed: usage guard, full typecheck, vp check, and clean Codex gpt-5.6-sol high autoreview (no accepted/actionable findings)

Explicitly left for later slices

• Slice A: /_asset-relay/:claim endpoint and server-to-server forwarding
• Slice B: client surface-origin advertisement and environment-aware URL rewriting
• Slice C: preview partition handling
• Slice D / feat: audience-scoped asset and filesystem guard (dseg slice 8) #208: multi-surface app-origin/backend binding and adversarial acceptance coverage

No project audience classification, pairing-grant ceiling, or listener-split behavior is changed.

[adamfgr]

Auto-approved by wizzo-approve: all policy conditions verified against HEAD 226cc90.