fix(people): require exact bearer-header scalar before parser dispatch #332

Finding

The canonical People authentication helper extract_bearer_token() is exported as a request-edge contract. It rejected None but otherwise called .split(), .casefold(), iteration, and ord() without first requiring an exact built-in str. The live ASGI parser supplied exact decoded text, but a direct consumer could pass a behavior-bearing str subclass and execute caller-defined parser behavior before authentication syntax validation.

Repair lineage

• Test-first 0ae465ba5e0066b2a64448c26d9a6ca4e39be9b7 adds a str subclass whose .split() raises if parser dispatch occurs.
• Causal repair 00d16ec6ef8db8fd0eaa7d65fd0666e9a2f9de6d requires exact built-in text before parser methods while preserving the existing None, case-insensitive Bearer scheme, printable-ASCII token, 8192-character bound, and no-token-logging contracts.
• Current canonical fix(people): harden governed People reads #55 exact head: 00d16ec6ef8db8fd0eaa7d65fd0666e9a2f9de6d.
• Ordinary-forward descendants: feat(people): add purpose-bound Employment history read #149 2b4689defb6ecf5f817ac88337070ee77b58f418, feat(people): expose employment history HTTP read #155 0a084b16da4dd21e99dcd6b4d3274ad1bf38c2b1, feat(people): add PostgreSQL Employment-history read adapter #156 563b538b7483dda5ec83c025c30311ccbb034fad.

Fresh exact-head Foundation/Security/CodeQL are queued and SAST is pending. No predecessor evidence transfers, hosted GREEN, self/model approval, force-push, destructive rebase, or gate weakening is claimed. Keep open until final #55 protected acceptance and integration.