fix(content-marking): reject boolean assertion version

[altrudev]

Closes #281.

What

content_marking.verify_assertion() compared the peer-supplied assertion version directly with integer 1:

if data.get("version") != ASSERTION_VERSION:

Because Python treats True == 1, a JSON assertion carrying "version": true was accepted as version 1.

This change establishes the boolean boundary explicitly before the existing version comparison:

version = data.get("version")
if isinstance(version, bool) or version != ASSERTION_VERSION:

The change is deliberately narrower than a general JSON-number rule. It does not make a claim about floating-point representations; it closes the unambiguous Python bool/int alias.

Regression coverage

Focused coverage holds:

• integer 1 -> unchanged success;
• boolean true -> refusal;
• boolean false -> refusal;
• string "1" -> refusal;
• null -> refusal;
• integer 2 -> refusal.

A dedicated regression names the mutation property: restoring the old plain != 1 comparison makes boolean true alias the supported version again.

Verification

The exact branch source and regression file were re-read after the writes. The predicate matrix was independently exercised for 1, true, false, "1", null, and 2; only integer 1 is accepted by the new condition, while the previous condition accepts both 1 and true.

A repository-wide pytest/ruff/mypy run is not claimed here because the available execution environment for this contribution does not currently have the TRACE checkout/toolchain. No GitHub Actions run is claimed.

Scope

Consumer-side primitive validation only. No wire-format, schema, cryptographic, downgrade, or C2PA behavior change.

AI-assistance disclosure: ChatGPT assisted with source triage, adversarial-case design, implementation drafting, and diff review. altrudev reviewed the bounded claim and remains responsible for the contribution.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[lywinged]

Approved on 37b8e2b over fc38496. Reproduced on main: an assertion from build_assertion() with data.version set to true passes verify_assertion(). On this head it is refused and integer 1 still passes; the PR's own test file has 2 of 7 cases failing against main and none here. Suite 1,174 passed, 1 skipped; ruff, mypy and the dash check clean. One thing outside the claim, for a follow-up rather than this PR: 1.0 passes on main and on this head, since 1.0 == 1 too, and a serializer that writes JSON numbers as floats will produce it.

Tool-assisted: the runs and this write-up.