fix(desktop): update collab smoke to the PeerIdentityPolicy admission API

The pairing-code hardening changed the admission exchange's
expected-subject parameter into PeerIdentityPolicy, but the smoke
harness only builds under --features test-issuer, which no workspace
gate compiles — CI's two-process collaboration step was the first
thing to notice. All four call sites now pass the SameAccount policy;
the full 8-scenario smoke run passes again.

crates/op-collab-smoke/src/auth.rs

@@ -5,7 +5,8 @@ use op_auth_bridge::{
 };
 use op_collab::VerifiedAuthMetadata;
 use op_collab_transport::{
-    verify_initial_ticket, AdmissionError, DeviceStaticKey, TicketVerifier, VerifiedTicketClaims,
+    verify_initial_ticket, AdmissionError, DeviceStaticKey, PeerIdentityPolicy, TicketVerifier,
+    VerifiedTicketClaims,
 };
 use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
@@ -125,6 +126,10 @@ pub const fn expected_issuer() -> &'static str {
     TEST_COLLAB_ISSUER
 }
 
-pub const fn expected_subject() -> &'static str {
-    TEST_SUBJECT
+/// The admission identity policy every smoke peer expects: both test devices
+/// are issued under the shared [`TEST_SUBJECT`] account.
+pub const fn expected_identity_policy() -> PeerIdentityPolicy<'static> {
+    PeerIdentityPolicy::SameAccount {
+        subject: TEST_SUBJECT,
+    }
 }

crates/op-collab-smoke/src/fault_transport.rs

@@ -1,4 +1,4 @@
-use crate::auth::{expected_issuer, expected_subject, SmokeAuth};
+use crate::auth::{expected_identity_policy, expected_issuer, SmokeAuth};
 use crate::fixtures;
 use anyhow::{bail, Context, Result};
 use op_collab::{CollabMessage, Commit, Epoch, FrameEnvelope, Role};
@@ -53,7 +53,7 @@ pub fn accept_guest(
         &local_hello,
         owner_auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         owner_auth.now_unix_ms(),
         Instant::now(),
     )?;
@@ -82,7 +82,7 @@ pub fn connect_owner(
         &hello,
         guest_auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         guest_auth.now_unix_ms(),
         Instant::now(),
     )?;

crates/op-collab-smoke/src/guest.rs

@@ -1,5 +1,5 @@
 use crate::auth::{
-    expected_issuer, expected_subject, SmokeAuth, GUEST_AVATAR_URL, GUEST_DEVICE_ID,
+    expected_identity_policy, expected_issuer, SmokeAuth, GUEST_AVATAR_URL, GUEST_DEVICE_ID,
     GUEST_DISPLAY_NAME, OWNER_AVATAR_URL, OWNER_DISPLAY_NAME,
 };
 use crate::fixtures;
@@ -34,7 +34,7 @@ pub fn run(address: SocketAddr) -> Result<String> {
         &hello,
         auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         auth.now_unix_ms(),
         Instant::now(),
     )?;

crates/op-collab-smoke/src/owner.rs

@@ -1,5 +1,5 @@
 use crate::auth::{
-    expected_issuer, expected_subject, SmokeAuth, GUEST_AVATAR_URL, GUEST_DISPLAY_NAME,
+    expected_identity_policy, expected_issuer, SmokeAuth, GUEST_AVATAR_URL, GUEST_DISPLAY_NAME,
     OWNER_AVATAR_URL, OWNER_DEVICE_ID, OWNER_DISPLAY_NAME,
 };
 use crate::fixtures;
@@ -84,7 +84,7 @@ fn serve(
         &local_hello,
         auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         auth.now_unix_ms(),
         Instant::now(),
     )?;