Summary

Follow-up to walt-id/waltid-identity#1885 that merges the current main mobile metadata work, resolves the SDK/API conflicts, and restores CI-compatible mobile verifier fixtures without relaxing the hardened request policy.

The branch preserves the secure default for unsigned Request Objects while keeping explicitly configured legacy compatibility consistent across the normal and manual wallet presentation paths.

What Changed

Main integration

• Merged main and retained both the OpenID4VP hardening from the parent PR and the current typed review-metadata, locale, and response-encryption SDK surface.
• Regenerated the Kotlin ABI reference and corrected the merged Swift bridge/model declarations so the native iOS SDK compiles cleanly.

Mobile fixtures and tests

• Create response-bound redirect_uri: demo verifier sessions and consume their direct authorization URLs instead of the unsigned JSON bootstrap endpoint.
• Keep mobile integration wallets fail-closed for Request Objects while retaining the direct, response-bound demo path.
• Update native iOS integration tests for the result-based preview API and structurally valid redirect_uri: client metadata.

Request-policy consistency

• Propagate each wallet's configured unsigned-request policy through the manual request-resolution path.
• Correct public KDoc to reference only the supported policy values.

Architecture Notes

• Demo fixtures deliberately exercise a direct request bound to the verifier response URI; production Request Object handling remains strict by default.
• The manual resolver now follows the same explicit compatibility policy as preview and presentation, rather than silently reverting to the secure default.

Caveats and Follow-Ups

• This branch does not alter enterprise mobile implementation or CI wiring.
• Native iOS PKIX support remains outside this follow-up's scope.

Breaking

• None.