spec: incorporate MeshCore discussion #2538 review feedback

Incorporates two of the three corrections raised by msmuenchen on
discussion #2538:

- Identity: document that the 64-byte Ed25519 private key is the
  expanded `a || RH` (orlp) form, not a 32-byte seed, and that it
  cannot be consumed by standard Ed25519 libraries. Touches
  15-identity.md and 14-crypto.md.
- Group: document the GRP_TXT/GRP_DATA inner plaintext format
  (timestamp + flags + message) and the GRP_TXT length limits in
  08-payload-group.md.

The third correction (GRP_DATA vs RAW_CUSTOM app differentiation) is
deferred pending reviewer clarification.

Corpus: replace the unrealistic group vectors with valid inner-format
plaintexts; the ed25519 vectors now carry the 64-byte expanded key and
the seed; the schema and validator gain seed fields. Also corrects two
pre-existing wrong values found while verifying -- ed-001's public key
and ed-002's signature now match RFC 8032.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

corpus/payloads/group/grp-data.json

@@ -3,7 +3,7 @@
   "name": "Group Data Payload",
   "spec_ref": "src/08-payload-group.md",
   "protocol_version": 0,
-  "description": "Tests group datagram payload. Same wire format as GRP_TXT but payload type = 0x06.",
+  "description": "Tests group datagram payload. Same wire format as GRP_TXT but payload type = 0x06. The encrypted plaintext is timestamp(4, LE) followed by an application-defined binary blob.",
   "vectors": [
     {
       "id": "grp-data-001",
@@ -22,17 +22,17 @@
         },
         "payload": {
           "channel_hash": "72",
-          "cipher_mac": "D184",
-          "ciphertext": "948C819389BA4ED7B1194A0FF8E62073"
+          "cipher_mac": "EFFF",
+          "ciphertext": "70917BC984A0AD4A409C3906B2266144"
         }
       },
-      "binary": "19 00 72 D184 948C819389BA4ED7B1194A0FF8E62073",
+      "binary": "19 00 72 EFFF 70917BC984A0AD4A409C3906B2266144",
       "crypto_context": {
         "shared_secret": "202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F",
         "encryption_key": "202122232425262728292A2B2C2D2E2F",
-        "plaintext": "47726F75704D736721"
+        "plaintext": "00F15365DEADBEEF0102030405"
       },
-      "notes": "Header 0x19 = GRP_DATA(6)+FLOOD(1). Same ciphertext as GRP_TXT since same key and plaintext."
+      "notes": "Header 0x19 = GRP_DATA(6)+FLOOD(1). Channel hash = SHA256(channel_secret)[0] = 0x72. Inner plaintext is the GRP_DATA format: timestamp 1700000000 (00F15365 LE) + the application-defined blob DEADBEEF0102030405. 13 bytes, AES-128-ECB zero-padded to 16. AES key = first 16 bytes of channel secret; MAC = HMAC-SHA256(channel_secret, ciphertext)[0..1]."
     }
   ]
 }

corpus/payloads/group/grp-txt.json

@@ -3,7 +3,7 @@
   "name": "Group Text Payload",
   "spec_ref": "src/08-payload-group.md",
   "protocol_version": 0,
-  "description": "Tests group text message payload: channel_hash(1) + cipher_mac(2) + ciphertext.",
+  "description": "Tests group text message payload: channel_hash(1) + cipher_mac(2) + ciphertext. The encrypted plaintext is the GRP_TXT inner format: timestamp(4, LE) + flags(1) + \"<sender_name>: <body>\".",
   "vectors": [
     {
       "id": "grp-txt-001",
@@ -22,23 +22,23 @@
         },
         "payload": {
           "channel_hash": "72",
-          "cipher_mac": "D184",
-          "ciphertext": "948C819389BA4ED7B1194A0FF8E62073"
+          "cipher_mac": "EC1C",
+          "ciphertext": "AE220A559CFF467B8F45948C2CABFD745BB36B14426A2127BB391DBBA51DE9E5"
         }
       },
-      "binary": "15 00 72 D184 948C819389BA4ED7B1194A0FF8E62073",
+      "binary": "15 00 72 EC1C AE220A559CFF467B8F45948C2CABFD745BB36B14426A2127BB391DBBA51DE9E5",
       "crypto_context": {
         "shared_secret": "202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F",
         "encryption_key": "202122232425262728292A2B2C2D2E2F",
-        "plaintext": "47726F75704D736721"
+        "plaintext": "00F1536500616C6963653A2068656C6C6F206D657368"
       },
-      "notes": "Channel hash = SHA256(channel_secret)[0] = 0x72. Plaintext 'GroupMsg!' (9 bytes). AES key = first 16 bytes of channel secret."
+      "notes": "Channel hash = SHA256(channel_secret)[0] = 0x72. Inner plaintext is the GRP_TXT format: timestamp 1700000000 (00F15365 LE) + flags 0x00 (TXT_TYPE_PLAIN) + the message \"alice: hello mesh\" (sender name \"alice\"). 22 bytes, AES-128-ECB zero-padded to 32. AES key = first 16 bytes of channel secret; MAC = HMAC-SHA256(channel_secret, ciphertext)[0..1]."
     },
     {
       "id": "grp-txt-002",
       "description": "Group text with tampered MAC must fail",
       "type": "invalid",
-      "binary": "15 00 72 0000 948C819389BA4ED7B1194A0FF8E62073",
+      "binary": "15 00 72 0000 AE220A559CFF467B8F45948C2CABFD745BB36B14426A2127BB391DBBA51DE9E5",
       "expected_error": "mac_invalid",
       "notes": "Same ciphertext as grp-txt-001 but MAC zeroed. Verification must fail."
     }