Update V2 design doc: attestation RID strategy matches implementation

[glandua]

Summary

The V2 attestation design doc (docs/claims-engine-v2-attestations.md, Section 4) describes an attestation RID strategy that includes verdict, rationale, and evidence_uris in the hash — meaning every verdict change would create a new RID.

The actual implementation (claims_router.py:_attestation_rid()) only hashes (claim_rid, reviewer_uri), making the RID stable across verdict updates. This is the correct approach for UPSERT semantics.

Current Doc (Section 4)

attestation_rid = orn:koi-net.attestation:{sha256(canonical_json)[:16]}

With canonical JSON including verdict, rationale, evidence_uris.

Actual Code

def _attestation_rid(claim_rid: str, reviewer_uri: str) -> str:
    obj = {"claim_rid": claim_rid, "reviewer_uri": reviewer_uri}
    canonical = json.dumps(obj, sort_keys=True, ...)
    h = hashlib.blake2b(canonical.encode(), digest_size=32).hexdigest()[:16]
    return f"orn:koi-net.attestation:{h}"

Proposed Change

Update Section 4 of the V2 design doc to:

1. Document the stable (claim_rid, reviewer_uri) RID strategy
2. Explain the rationale: "Same reviewer + claim always yields the same RID, making UPSERT safe. Verdict changes are mutations on the same record, not new records."
3. Note the algorithm is BLAKE2b (not SHA256 as the doc implies)