feat: integrate flamingo into walletkit-core

[Dzejkop]

This PR integrates attested Flamingo matching into WalletKit core.

• Add the native matcher API with pinned enclave measurements, typed outcomes, and one reassignment retry.
• Pin the verifier client and shared types to the Pontifex 2.0.0 migration in Flamingo #97 and remove attested-channel.
• Keep the optional CLI demo in the separate draft PR feat: add flamingo match cli demo #510.

Validation: 9 Flamingo core tests, 9 existing CLI unit tests, Clippy, and formatting pass on Rust 1.94.1. Live enclave E2E was not run.

[Dzejkop]

@claude review

[Copilot]

Pull request overview

This PR integrates the Flamingo attested face-matching flow into walletkit-core (replacing the prior DeepFace integration conceptually) and adds a walletkit-cli subcommand to exercise the published Flamingo verifier APIs end-to-end.

Changes:

• Adds a native-only walletkit_core::flamingo module exposing a UniFFI-friendly FlamingoMatcher and match request/response types.
• Introduces a walletkit-cli flamingo match command that reads input images, validates thumbnail commitments, performs an attested match, and emits a JSON artifact.
• Updates workspace dependencies / lockfiles and Cargo-deny license clarifications to accommodate the new Flamingo/attestation crates.

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
flake.lock	Updates rust-overlay pin used by the Nix environment.
deny.toml	Adds a webpki license clarification needed by new deps.
crates/walletkit-core/tests/authenticator_integration.rs	Minor formatting cleanup in integration test output.
crates/walletkit-core/src/lib.rs	Exposes new flamingo module for non-wasm builds.
crates/walletkit-core/src/flamingo.rs	New core Flamingo matcher implementation + unit tests.
crates/walletkit-core/Cargo.toml	Adds native-only deps for Flamingo verifier + attested channel.
crates/walletkit-cli/src/commands/mod.rs	Wires a new top-level Flamingo CLI subcommand.
crates/walletkit-cli/src/commands/flamingo.rs	Implements CLI match demo + statement verification + tests.
crates/walletkit-cli/Cargo.toml	Adds CLI deps needed for attestation + statement verification.
Cargo.toml	Adds Flamingo + attestation crates to workspace dependencies.
Cargo.lock	Locks new transitive dependency graph for Flamingo integration.

Suppressed comments (1)

crates/walletkit-cli/src/commands/flamingo.rs:415

• P2: The unit test currently asserts that save_statement overwrites existing files, which contradicts the CLI arg docs (“Existing files are never overwritten”) and encourages risky default behavior. Update the test to assert that the second write fails and the original contents remain (or update the docs if overwrite is intended).

    #[test]
    fn statement_output_overwrites_existing_files() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("statement.json");
        save_statement(&path, &json!({"token": "longer original token"})).unwrap();
        save_statement(&path, &json!({"token": "second"})).unwrap();
        assert_eq!(
            serde_json::from_slice::<Value>(&fs::read(path).unwrap()).unwrap()["token"],
            "second"
        );
    }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.