Port the complete override with contained identities and bounded recursion.
Reuse the virtual curve validator, preserve the pinned default-label behavior,
and add native construction, guards and a separate generated case stream.
Rust targeted tests, workspace Clippy without cpp, and wasm checks pass.
Native validation remains pending SSH key-agent access; no green claim is made.
Co-Authored-By: Codex <noreply@openai.com>