Function needs_root_resolution 

pub fn needs_root_resolution(
    principal: &Principal,
    chain: &[DelegationStep],
    selected: &CardUid,
) -> Result<bool, WyrdError>

Whether a request’s selected workload root must still be resolved for a verified bearer.

A bearer whose owning root (owning_root) is already signed is immutable: an equal selector is an idempotent Ok(false) and a different one is refused, never unpinned. A rootless bearer answers Ok(true), and the selector is resolved under its signed Card access. Every ingress routes a selector through here, so none silently drops or rebinds one.

Errors

Returns WyrdError::SignedWorkloadMismatch when selected differs from the signed root.