docs: finish zone reference hardening workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tools/resolve_zones.py

@@ -124,9 +124,11 @@ def _validate_identity(service: str, identity: Any) -> dict[str, Any]:
             _required(binding, key, where)
         if binding["principal_type"] not in {"service", "agent"}:
             raise DeclarationError(f"{where}.principal_type must be service or agent")
-        identity_key = tuple(
-            str(binding[key])
-            for key in ("scheme", "authority", "subject", "principal_type")
+        identity_key = (
+            str(binding["scheme"]),
+            str(binding["authority"]),
+            str(binding["subject"]),
+            str(binding["principal_type"]),
         )
         if identity_key in seen:
             raise DeclarationError(f"{where} duplicates an identity binding")