Turns a wire-level credential into a verified IdentityId. Authorisation belongs to the policy engine, so a
deployment can swap authentication methods without touching policy enforcement.
Invariant: a successful authentication yields an IdentityId that resolves through the catalog to a real,
non-revoked identity. Minting one outside this crate bypasses revocation and is a security regression.