fix(ac-0024): injective C identity via SHA-256 length-prefix digest + PostgreSQL migration/round-trip tests

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

tests/application/test_reconcile_notification.py

@@ -845,16 +845,25 @@ def test_publish_alarm_returns_bool():
 # Regression tests for ac-0024 blocker fixes
 # ---------------------------------------------------------------------------
 
-def test_c_identity_key_contains_no_nul_byte():
-    """_c_identity_key must not contain NUL (\\x00) — PostgreSQL TEXT bind would fail."""
+def test_c_identity_key_is_injective_and_postgres_safe():
+    """_c_identity_key must be injective (no collisions) and PostgreSQL TEXT-safe.
+
+    Specifically verifies the crafted-separator collision that bit the \\x1f
+    implementation: ('a\\x1fC', 'b') and ('a', 'C\\x1fb') previously produced
+    the same key and suppressed the second detected event.
+    """
     key = _c_identity_key("my-instance", "005930")
     assert "\x00" not in key, f"identity key contains NUL: {key!r}"
-    # Must still be collision-resistant (different symbols must produce different keys)
-    key2 = _c_identity_key("my-instance", "005931")
-    assert key != key2
-    # Must still be collision-resistant (different instances must produce different keys)
-    key3 = _c_identity_key("other-instance", "005930")
-    assert key != key3
+    # Different symbols → different keys
+    assert key != _c_identity_key("my-instance", "005931")
+    # Different instances → different keys
+    assert key != _c_identity_key("other-instance", "005930")
+    # Crafted-separator collision must not exist
+    crafted_a = _c_identity_key("a\x1fC", "b")
+    crafted_b = _c_identity_key("a", "C\x1fb")
+    assert crafted_a != crafted_b, (
+        f"Separator-crafted collision: both produce {crafted_a!r}"
+    )
 
 
 def test_retry_pending_resolved_ignores_other_instance_states():