[rubenvdlinde]

REVIEW, held. Follow-up to RW149's review of #1459, and stacked on it: the diff shows #1459's commits until that one merges. The change here is the last commit.

What

• Both certificate parsers now refuse a DER length written in a longer form than needed: the long form for a length of 127 or less (01 81 01 ff), or a long form with a leading zero byte (82 00 80), as X.690 10.1 requires. A length of 128 (81 80) still reads.
• New tests pin that a critical flag must be a BOOLEAN, in both parsers (RW149's mutants W6 and X10). The check itself already existed.

Like #1459, every changed outcome is a refusal.

Evidence

• Failing first: the 4 length cases fail on fix(federation): read certificate flags and integers as strict DER #1459's parsers (web 96 of 100 passed, extension 101 of 105) and all pass now (web 100/100, extension 105/105).
• Differential with RW135's chain harness (3,048 well-formed chains, fix(federation): read certificate flags and integers as strict DER #1459 against this): 0 diffs, so chains with minimal lengths are unaffected.
• Capped mutants, no-op control survived. Web 5/5 and extension 5/5 killed: short form allowed, leading zero allowed, the boundary at 128, the flag's tag check removed (X10 and W6), the cursor not moved past the length bytes.
• eslint and prettier clean on the touched files. tlv stays under McCabe 10 (web 8, extension 6). The new helper takes one parameter.
• The full suite ran once over the KQ3 stack, which includes this commit; the result follows as a comment.

AI-assisted: written with Claude Code (claude-opus-5-5) and checked by the lane before opening.