[cryptography/stream] Version SAKE and bind identities before signing

Add sake::Version and cups::Version. V1 commits both static identities
before every handshake signature, so the Syn signature covers the dialer
identity, and uses injective transcript::Version::V1 framing. V0 keeps the
existing transcript byte-for-byte. Both sake::Context::new and
cups::Handshake::new require the version: it is not negotiated, so every
caller chooses it explicitly, and library code never picks one on behalf
of an operator.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: cronokirby

RELEASE_NOTES.md

@@ -16,6 +16,9 @@ To retain a path back to v2026.7.1:
   before the upgraded binary first opens storage. The previous binary cannot
   read V1 blobs, and this release has no V1-to-V0 downgrade tool. Narrowing the
   range after V1 blobs exist rejects them instead of converting them ([#4595]).
+- **V1 handshakes:** Pass `cups::Version::V0` to `cups::Handshake::new` on
+  every peer. A V1 peer cannot complete a handshake with a V0 peer, and the
+  version is not negotiated.
 - **Page-size changes:** Keep each existing store's logical page size.
   Replacing a logical size of 4096 with `buffer::paged::page_size(4096)` changes
   it to 4084 and can truncate existing data. Switching the setting back cannot
@@ -381,6 +384,19 @@ are the same types and separate trait impls for both now conflict ([#4318]). The
 `Blocker` trait gained a required `blocked()` method returning a latest-wins
 subscription to the set of peers the network currently blocks ([#4645]).
 
+SAKE handshakes are versioned. `handshake::sake::Context::new` and
+`cups::Handshake::new` take a mandatory version, and `cups::Handshake` gains a
+public `version` field. V1 commits both static identities before every signature, so the
+first handshake message's signature covers the dialer identity, and uses the
+injective `transcript::Version::V1` framing. Under V0 that signature covers only
+the timestamp, listener identity, and ephemeral key, which lets a signature
+scheme that allows selecting a public key for an existing signature pass the
+listener's first check under an identity the sender does not own; the exchange
+still cannot complete under a mismatched identity. Message encodings are
+unchanged, but peers must agree on a version: a mismatch fails with
+`HandshakeFailed`. Upgrade a running network in two steps: first deploy with
+`V0` everywhere, then switch every peer to `V1` together.
+
 ### Resolver
 
 Resolver consumers report a typed `Outcome` instead of a bool ([#4383],

cryptography/conformance.toml

@@ -150,10 +150,14 @@ hash = "9010ca9b2849258179377f855fb77967ff003c8f349258d868bab76b0bfa1c5a"
 n_cases = 65536
 hash = "0cbb8c8644dffe0be78d1307fb5034dd804921d66799c1aaec3d335b44e9616c"
 
-["commonware_cryptography::handshake::sake::conformance::Sake"]
+["commonware_cryptography::handshake::sake::conformance::SakeV0"]
 n_cases = 4096
 hash = "057cc42a74390f0b43250b8fba2c42abad651bee6beacb510f2f2a950185a694"
 
+["commonware_cryptography::handshake::sake::conformance::SakeV1"]
+n_cases = 4096
+hash = "564d2e1cdc69b2047bd75ed78ae89402371db5ea8d8abd9f647e4b134fcf98bf"
+
 ["commonware_cryptography::handshake::sake::key_exchange::conformance::CodecConformance<EphemeralPublicKey>"]
 n_cases = 65536
 hash = "c0501d4a691d1fccec7c5906e8608228569d24164150edd215838593e3b77512"