feat: migrate refimpls from draft-00 to draft-01 claim names

- Rename `par` to `pred` (predecessor) in types, serialization, tests
- Remove `pol`, `pol_decision` from core payload; move to `ect_ext`
- Remove `sub` from payload (not part of ECT spec)
- Update `typ` from `wimse-exec+jwt` to `exec+jwt` (accept both)
- Rename MaxParLength to MaxPredLength everywhere
- Update testdata, demos, READMEs with migration table
- All Go tests pass, all 56 Python tests pass (90% coverage)

refimpl/python/tests/test_verify.py

@@ -13,7 +13,6 @@ from ect import (
     verify,
     VerifyOptions,
     default_verify_options,
-    POL_DECISION_APPROVED,
 )
 
 
@@ -22,7 +21,7 @@ def test_parse():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["a"], iat=now, exp=now + 3600,
-        jti="jti-parse", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-parse", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     parsed = parse(compact)
@@ -41,7 +40,7 @@ def test_verify_expired():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["v"], iat=now - 3600, exp=now - 60,
-        jti="jti-exp", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-exp", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -54,7 +53,7 @@ def test_verify_replay():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["v"], iat=now, exp=now + 3600,
-        jti="jti-replay", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-replay", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -76,7 +75,7 @@ def test_verify_audience_mismatch():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["other"], iat=now, exp=now + 3600,
-        jti="jti-a", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-a", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -89,7 +88,7 @@ def test_verify_wit_subject_mismatch():
     now = int(time.time())
     p = Payload(
         iss="wrong-iss", aud=["v"], iat=now, exp=now + 3600,
-        jti="jti-w", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-w", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -104,7 +103,7 @@ def test_verify_iat_too_old():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["v"], iat=now - 2000, exp=now + 3600,
-        jti="jti-old", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-old", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -119,7 +118,7 @@ def test_verify_unknown_key():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["v"], iat=now, exp=now + 3600,
-        jti="jti-k", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-k", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: None  # unknown key
@@ -132,7 +131,7 @@ def test_verify_resolve_key_required():
     now = int(time.time())
     p = Payload(
         iss="iss", aud=["v"], iat=now, exp=now + 3600,
-        jti="jti-r", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-r", exec_act="act", pred=[],
     )
     compact = create(p, key, CreateOptions(key_id="kid"))
     with pytest.raises(ValueError, match="ResolveKey"):
@@ -146,7 +145,7 @@ def test_verify_with_dag():
     now = int(time.time())
     root = Payload(
         iss="iss", aud=["v"], iat=now, exp=now + 3600,
-        jti="jti-root", exec_act="act", par=[], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-root", exec_act="act", pred=[],
     )
     compact_root = create(root, key, CreateOptions(key_id="kid"))
     resolver = lambda kid: key.public_key() if kid == "kid" else None
@@ -155,7 +154,7 @@ def test_verify_with_dag():
     ledger.append(compact_root, parsed.payload)
     child = Payload(
         iss="iss", aud=["v"], iat=now + 1, exp=now + 3600,
-        jti="jti-child", exec_act="act2", par=["jti-root"], pol="p", pol_decision=POL_DECISION_APPROVED,
+        jti="jti-child", exec_act="act2", pred=["jti-root"],
     )
     compact_child = create(child, key, CreateOptions(key_id="kid"))
     parsed2 = verify(compact_child, opts)
@@ -166,7 +165,7 @@ def test_on_verify_attempt_callback():
     """Observability: on_verify_attempt is called with jti and error (or None)."""
     key = generate_key()
     now = int(time.time())
-    p = Payload(iss="i", aud=["v"], iat=now, exp=now + 3600, jti="jti-obs", exec_act="a", par=[])
+    p = Payload(iss="i", aud=["v"], iat=now, exp=now + 3600, jti="jti-obs", exec_act="a", pred=[])
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda k: key.public_key() if k == "kid" else None
     seen = []
@@ -183,7 +182,7 @@ def test_on_verify_attempt_callback():
 def test_on_verify_attempt_called_on_failure():
     key = generate_key()
     now = int(time.time())
-    p = Payload(iss="i", aud=["v"], iat=now, exp=now - 1, jti="jti-fail", exec_act="a", par=[])
+    p = Payload(iss="i", aud=["v"], iat=now, exp=now - 1, jti="jti-fail", exec_act="a", pred=[])
     compact = create(p, key, CreateOptions(key_id="kid"))
     resolver = lambda k: key.public_key() if k == "kid" else None
     seen = []
@@ -193,5 +192,3 @@ def test_on_verify_attempt_called_on_failure():
     assert len(seen) == 1
     assert seen[0][0] == "jti-fail"
     assert seen[0][1] is not None
-
-