Update World ID Protocol crates to 0.14

[Dzejkop]

Rationale

WalletKit still targeted the 0.13 World ID Protocol crates. This updates the generic native and WASM codepaths to the released 0.14 crates so PR #480 can later rebase onto a clean protocol upgrade.

Changes

• Upgrade world-id-core and world-id-proof to crates.io 0.14 releases.
• Migrate WalletKit and testkit to SessionRef::None, SessionRef::Create, and SessionRef::Existing.
• Make the CLI follow the 0.14 model directly: proof type session creates a session when no session ID is supplied and references an existing session when one is supplied.
• Bind ownership proof generation and verification to the new context field.
• Pass WalletKit request time into the released generate_nullifier API.
• Update renamed request-auth and primitive errors.
• Pin direct taceo-oprf to =0.18.1.

No browser or WASM POC code, UniFFI downgrade, ubrn patch, example, or temporary world-id Git patch is included.

Dependency resolution caveat

World ID Protocol 0.14 declares taceo-oprf 0.18.1 with a compatible range. Cargo would otherwise select 0.18.2, which moved to Arkworks 0.6 and conflicts with the Arkworks 0.5 types used by World ID Protocol 0.14. The exact =0.18.1 pin keeps one shared Taceo OPRF version. The resolved graph contains taceo-oprf 0.18.1 and no Arkworks 0.6 packages.

Validation

• cargo fmt --all -- --check
• cargo check --workspace --all-targets in the pinned Nix shell
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy --workspace --all-targets --no-default-features -- -D warnings
• cargo check -p walletkit --features embed-zkeys --target wasm32-unknown-unknown in the pinned WASM shell
• focused CLI SessionRef tests: 4 passed
• workspace all-features nextest run: protocol proof and session E2E tests passed; two stale CLI expectations found by the run were updated and their focused rerun passes
• cargo deny check bans licenses sources
• cargo deny check advisories
• cargo tree confirms a single taceo-oprf 0.18.1 and no Arkworks 0.6 reverse dependencies

One unrelated local integration test could not start because the anvil executable is not installed: test_authenticator_integration failed with SpawnError / No such file or directory.

---

Note

High Risk
Touches proof generation, session semantics, and ownership-proof cryptography on upgraded protocol crates; incorrect dependency resolution or API wiring could break proofs or verification.

Overview
Upgrades WalletKit to world-id-core / world-id-proof 0.14 and pins taceo-oprf to =0.18.1 so Cargo does not pull 0.18.2 (Arkworks 0.6), which would conflict with 0.14’s Arkworks 0.5 stack. Cargo.lock reflects the bumped protocol and OPRF crates.

Session handling moves from optional session_id plus a separate create-session proof type to SessionRef::None / Create / Existing. The CLI and testkit now treat --proof-type session without --session-id as session creation and with an ID as proving an existing session; legacy create-session is rejected.

Ownership proofs (WIP-103) now require a context field end-to-end: prove_credential_sub, CLI proof verify-ownership, and verification helpers. Nullifier generation passes the wallet now timestamp into the updated upstream API.

Error mapping is adjusted for 0.14 (CreatedAtTooOld / CreatedAtTooFarInFuture, SessionIdCommitmentMismatch → SessionIdMismatch). CI pins Foundry 1.7.1 in lint and test jobs.

^{Reviewed by Cursor Bugbot for commit 3da0273. Bugbot is set up for automated code reviews on this repo. Configure here.}