Class PinnedRoots

The pinned root keys of the licence system (LICENSE-V2-DESIGN.md section 2.4, rulings LV-3 and RB-7 (a)): the one set the licence client, the MLS and the hub principal verify key certificates under, here in com.iizix.core where all three reach it. The constant is not secret; what protects it from substitution is the loader - the licence code is mangled and encrypted in the .dat files and loads only when the caller jar and the core jar carry Mindus's EV chain (LicenseSystem.java), so changing a root is a re-signed release.

The roots of the ceremony of LV-4, held on 2026-10-24 (ROOT-CEREMONY.md): the two root pairs (the current root root-2026-a and its successor root-2026-b) were generated offline by the owner, and their public halves are pasted here, one line per root: RootKey.of("root-2026-a","...") with the 43-character text of Ed25519.publicKeyToBase64Url(java.security.PublicKey). No private key of any root is ever in the tree, on the MLS host or in the credential store the build scripts read.

While the list is empty, LicenseVerifier.pinned(java.time.Clock) logs SEVERE at construction and refuses every licence document and key certificate at step 1: a build cannot accept a licence by accident.

Retiring a root is a release that pins the successor and a new successor; clients one release behind still verify, because the MLS signing key is certified by the root both releases pin (2.4).