20260922 对齐 OSS 验证配置并补充 public TOML E2E

src/validation/policy.rs

@@ -42,10 +42,12 @@ impl ResourceValidationMode {
 }
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(default)]
+#[serde(default, deny_unknown_fields)]
 pub struct StrictPolicy {
     pub name: bool,
+    #[serde(alias = "cms-der")]
     pub cms_der: bool,
+    #[serde(alias = "signed-attrs")]
     pub signed_attrs: bool,
 }
 
@@ -180,6 +182,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn policy_toml_accepts_public_kebab_case_strict_keys() {
+        let policy = Policy::from_toml_str(
+            r#"
+            [strict]
+            name = true
+            cms-der = true
+            signed-attrs = false
+            "#,
+        )
+        .expect("parse public strict keys");
+        assert_eq!(
+            policy.strict,
+            StrictPolicy {
+                name: true,
+                cms_der: true,
+                signed_attrs: false,
+            }
+        );
+    }
+
     #[test]
     fn policy_toml_accepts_resource_validation_mode() {
         let policy = Policy::from_toml_str(