Emit one-way callback identity fingerprints

[clarkchenkai]

What changed

• Add domain-separated SHA-256 fingerprints for access-approved callback chat, operator, and message identities.
• Include the one-way values in structured command callback telemetry without exposing raw provider identifiers.
• Add unit vectors and an integration assertion at the authorized callback boundary.

Why

Optional local telemetry consumers need stable one-way identifiers to authorize downstream callback processing. Keeping this contract upstream prevents package upgrades from silently removing a local-only patch.

Security

• Fingerprints are emitted only after the normal bridge access policy approves the callback.
• Identity kind and versioned domain are included in each hash preimage to prevent cross-class correlation.
• Raw provider identifiers are not passed to telemetry consumers.

Validation

• pnpm ci:local
• 96 test files / 598 tests passed
• Typecheck and production build passed