Explicit Docker Unix-HTTP identity contract. No I/O or daemon attestation. Independent of v1: no automatic request, lease or persisted-intent conversion.