Cross-population identity proofs require component-expanded commitments
A reusable correction from COR-3791: shared HMAC domains plus each selected row's direct identity tokens do not prove disjointness when protected populations are projected independently. A hidden transitive bridge can connect A—B in one population and B—C in another while selecte…