refactor: expose credential preflight checks on ProofRequest

[chipp]

Expose the existing credential preflight check as ProofRequest::check_credentials(store, now), rebased onto current main and the crates/ layout. The check reports local credential availability and time constraints per request item, then evaluates the request's constraint expression without generating a proof.

Reuse protocol 0.14's validate_constraints() instead of duplicating tree depth/node limits, map unexpected validation errors without panicking, and build one diagnostic per request item with an iterator. No dependency changes are needed.

Keep check_credentials_against_proof_request and its original Rust result/error import paths as a forwarding compatibility API: Android and iOS still use it. Current test coverage is preserved rather than dropped during the rebase, with an additional method-versus-legacy equivalence test.

Validation: all 18 credential-preflight tests pass, including legacy API equivalence. Strict Clippy (cargo clippy -p walletkit-core --lib --tests -- -D warnings), formatting, and git diff --check pass. CI is running on the rebased branch for generated foreign bindings and the complete workspace.

---

Note

Medium Risk
Touches proof-request credential gating used before proof generation and FFI surfaces, though behavior is intended to stay the same aside from centralized constraint validation.

Overview
Moves credential preflight logic into requests/credential_check and exposes ProofRequest::check_credentials(store, now) as the primary API (UniFFI-exported). The old proof_request_credential_constraints_check module is now a thin re-export so check_credentials_against_proof_request and existing import paths keep working for mobile bindings.

Implementation changes: constraint limits go through CoreProofRequest::validate_constraints() instead of inline depth/node checks, with CredentialConstraintsCheckError::Unknown for other validation failures. The legacy free function forwards to the method; tests are relocated and a method_and_legacy_api_agree test locks parity.

^{Reviewed by Cursor Bugbot for commit 6b48ddf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chipp]

• refactor: expose credential preflight checks on ProofRequest #411 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[paolodamico]

I think this is implementing duplicate logic from https://github.com/worldcoin/world-id-protocol/blob/ada9887a40255ce7e8576cbca4e0442c049d887d/crates/primitives/src/request/mod.rs#L374. is this performing any additional action from just exposing that method to foreign code?

[chipp]

I will reuse this method for constraints evaluation, thanks for sharing.

however, check_credentials applies time constraints per item and returns per-item diagnostics for UI before triggering ZK proof generation.
there are two options (or more, idk) here:
— keep in walletkit: time checks stay here, can't reuse protocol's since they're buried in circuit input validation.
— add to protocol primitives: expose time checks as a reusable method, walletkit just maps storage records → protocol types.