fix(runtime): remove dead helpers left behind by Phase 9 + Phase 12

MSVC under /W4 /WX doesn't flag unused anonymous-namespace functions
as errors (they compile fine and get DCE'd), but clang/gcc with
-Werror -Wunused-function do. CI caught six orphans that the local
Windows build had happily buried:

  runtime/src/provider/local_embedded.cpp — Phase 9 fallout
    parse_provider_class_text
    parse_policy_floor_uint
    parse_recovery_model_uint
    parse_bool_uint
    is_known_requirement_key

  Every validation these five helpers used to do is now covered by
  the schema-driven parser's field descriptors (EnumUintField,
  EnumTextArrayField, BoolField, reject_unknown_keys). Leave a
  one-line comment pointing at the replacement so nobody re-adds
  them thinking they're missing.

  runtime/src/tokens.cpp — Phase 6 fallout
    require_bytes

  Previously called by the now-removed verify_auth_wrapper helper
  that Phase 6 (signed_partition template) replaced. The wrapper's
  signature_bytes reach comes through the SignedPartitionView now,
  no call site left.

All 1124 tests still green on dev-win. Should unblock clang-18,
gcc-14, and apple-clang CI.

Author: scc-tw

runtime/src/provider/local_embedded.cpp

@@ -79,65 +79,11 @@ constexpr std::size_t kMaxAllowedProviderClassesLength = 8;
 
 constexpr std::string_view kRequirementVersionV1 = "policy-requirement-v1";
 
-tl::expected<ProviderClass, PolicyRequirementParseError>
-parse_provider_class_text(std::string_view s) noexcept {
-    if (s == "local_embedded")      return ProviderClass::LocalEmbedded;
-    if (s == "local_tpm")           return ProviderClass::LocalTpm;
-    if (s == "local_tee")           return ProviderClass::LocalTee;
-    if (s == "cloud_attested_vm")   return ProviderClass::CloudAttestedVm;
-    if (s == "cloud_hsm")           return ProviderClass::CloudHsm;
-    if (s == "external_kms")        return ProviderClass::ExternalKms;
-    return tl::make_unexpected(PolicyRequirementParseError::UnknownEnumValue);
-}
-
-tl::expected<VMPilot::DomainLabels::PolicyId, PolicyRequirementParseError>
-parse_policy_floor_uint(std::uint64_t v) noexcept {
-    using VMPilot::DomainLabels::PolicyId;
-    switch (v) {
-        case static_cast<std::uint64_t>(PolicyId::Debug):    return PolicyId::Debug;
-        case static_cast<std::uint64_t>(PolicyId::Standard): return PolicyId::Standard;
-        case static_cast<std::uint64_t>(PolicyId::HighSec):  return PolicyId::HighSec;
-    }
-    return tl::make_unexpected(PolicyRequirementParseError::UnknownEnumValue);
-}
-
-tl::expected<RecoveryModel, PolicyRequirementParseError>
-parse_recovery_model_uint(std::uint64_t v) noexcept {
-    switch (v) {
-        case static_cast<std::uint64_t>(RecoveryModel::SelfService):
-            return RecoveryModel::SelfService;
-        case static_cast<std::uint64_t>(RecoveryModel::SignedReprovision):
-            return RecoveryModel::SignedReprovision;
-        case static_cast<std::uint64_t>(RecoveryModel::Quorum):
-            return RecoveryModel::Quorum;
-    }
-    return tl::make_unexpected(PolicyRequirementParseError::UnknownEnumValue);
-}
-
-tl::expected<bool, PolicyRequirementParseError>
-parse_bool_uint(std::uint64_t v) noexcept {
-    if (v == 0) return false;
-    if (v == 1) return true;
-    return tl::make_unexpected(PolicyRequirementParseError::UnknownEnumValue);
-}
-
-bool is_known_requirement_key(std::uint64_t k) noexcept {
-    switch (k) {
-        case kReq_RequirementVersion:
-        case kReq_RequiredPolicyFloor:
-        case kReq_RequiredFamilySet:
-        case kReq_RequireHardwareBound:
-        case kReq_RequireNonExportableKey:
-        case kReq_RequireOnlineFreshness:
-        case kReq_RequireRemoteAttestation:
-        case kReq_RequireRecoveryModel:
-        case kReq_AllowedProviderClasses:
-        case kReq_MinimumProviderEpoch:
-            return true;
-        default:
-            return false;
-    }
-}
+// Phase 9 replaced the hand-rolled helpers (parse_provider_class_text,
+// parse_policy_floor_uint, parse_recovery_model_uint, parse_bool_uint,
+// is_known_requirement_key) with the schema-driven parser. The schema
+// descriptors (EnumUintField / EnumTextArrayField / BoolField /
+// reject_unknown_keys) cover every validation the helpers used to do.
 
 // ProviderEvidence canonical schema (strict CBOR map, uint keys):
 //

runtime/src/tokens.cpp

@@ -86,9 +86,6 @@ inline tl::unexpected<TokenError> err(TokenError code) noexcept {
 inline auto require_text(const Value& m, std::uint64_t k) noexcept {
     return VMPilot::Cbor::require_text<TokenError>(m, k);
 }
-inline auto require_bytes(const Value& m, std::uint64_t k) noexcept {
-    return VMPilot::Cbor::require_bytes<TokenError>(m, k);
-}
 inline auto require_hash32(const Value& m, std::uint64_t k) noexcept {
     return VMPilot::Cbor::require_hash<TokenError, 32>(m, k);
 }