fix(asn1)!: enforce the matrix event decoder

[sephynox]

Summary

Recorded instrumentation events could not be read back at all: the encoder wrote its fields flat and the decoder demanded a SEQUENCE that was never written. The wire matrix had public fields whose documented data.len() == n * n rule nothing enforced, while a second type in the same crate already enforced it.

Related Issues

None

Changes Made

• A recorded TbEvent decodes back into the event that was written
• A wrong-length payload hash is refused, not read as absent
• A decoded matrix passes the same constructor as a built one
• Metadata.matrix carries MatrixDyn instead of Asn1Matrix

Testing

• make test-all passes across all 54 feature selections
• cargo test --lib instrumentation:: covers the round trip and both hash lengths
• cargo hack check --each-feature catches imports the all-features build cannot

Breaking Changes

• Asn1Matrix is deleted. Metadata.matrix is Option<MatrixDyn>.
  • Build one with MatrixDyn::from_row_major(n, bytes)
• A TbEvent whose payload hash is not 32 bytes now fails to decode instead of decoding with no hash.

---

Note

Medium Risk
Breaking API removal of Asn1Matrix and stricter TbEvent/matrix decode behavior can reject previously tolerated wire data; changes touch metadata encoding and instrumentation evidence paths.

Overview
Replaces the V3 metadata matrix wire type by removing Asn1Matrix and using MatrixDyn everywhere (Metadata.matrix, builders, chess/fault-matrix helpers). Matrix DER encode/decode and the n*n length rule now live on MatrixDyn via from_row_major, so decoded values match constructed ones.

Hardens instrumentation TbEvent DER decoding: the decoder respects the SEQUENCE declared length (read_nested), rejects truncated or padded bodies, and treats a present payload hash that is not exactly 32 bytes as malformed instead of decoding as absent. New tests cover round-trip, length tampering, and hash-length cases.

Breaking: Asn1Matrix is gone; build matrices with MatrixDyn::from_row_major(n, bytes). Non–32-byte payload hashes on the wire now fail decode.

^{Reviewed by Cursor Bugbot for commit 5d8d971. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c271cea. Configure here.}