Prove the capability-version handshake against an independent TS2021 oracle

[forkwright]

Finding

Issue #64 unified Hamma's capability version and fixed the TS2021 byte order, but its independent interoperability oracle never landed. The remaining tests prove internal consistency and a self-paired Snow handshake; they do not prove that the selected capability and prologue complete against an independently implemented or captured reference endpoint.

Evidence

• crates/dictyon/src/noise/tests.rs:31-59 pins the exact 00 47 initiation bytes, which is useful byte-order coverage but not an interoperability oracle.
• crates/dictyon/tests/wire_integration.rs:27-40 derives the mock server's prologue from Hamma's own CAPABILITY_VERSION.
• crates/dictyon/tests/wire_integration.rs:277-343 builds the responder with the same Snow algorithm and derived prologue as the client.
• Closed Derive every control-plane version from one truthful capability and encode TS2021 big-endian #64 explicitly required a captured/reference-vector test and an independently implemented oracle. That acceptance item has no repository evidence.

Why this matters

A self-consistent client and fixture can share the same wrong capability claim or transcript convention and remain green. Hamma must not promote the control-plane gate—or use it to authorize later ACL/data-plane work—without immutable evidence from outside its own implementation.

Desired correction

Capture or independently implement the TS2021 oracle and publish a typed receipt under evidence/phase-a/ that binds:

• the exact Hamma producer commit;
• oracle identity and revision;
• request/response or vector artifacts with SHA-256 hashes;
• exact initiation bytes and Noise prologue;
• a successful handshake plus the failure case for a mismatched version.

The Phase A contract may mark this evidence complete only after its receipt validator accepts the immutable artifacts.

Done when: current Hamma completes the capability-version handshake against the independent oracle, the exact artifacts are hash-bound in-repo, and a regression test fails if Hamma's version, byte order, or prologue diverges.