dpp-registry: mandatory Article-13 identifier fields can be empty and still pass validate()

[LKSNDRTMLKV]

Static read-through audit of crates/dpp-registry. No unsafe, no crypto surface, no TODO markers. Three verified findings, all in the one payload-validation gate that sits before EU registry submission.

1. item_id has no validation at all

Location: src/registry/payload.rs:46-56
Issue: RegistrationPayload::validate()'s doc comment claims it validates "all four Article-13 identifiers," but item_id (ProductItemIdentifier) has no validate() method anywhere in identifiers.rs and is never checked.
Failure scenario: A payload with item_id: { scheme: "", value: "", batch_id: None } passes validate() — a structurally empty mandatory identifier reaches the pre-submission checkpoint undetected.

2. Empty country code is explicitly accepted

Location: src/registry/identifiers.rs:12-23 (validate_country_code)
Issue: An empty country string always returns Ok(()) ("unknown/not-yet-set is acceptable pre-go-live"), backing both FacilityIdentifier and OperatorIdentifier, where country: String is a non-Option, documented-as-required field.
Failure scenario: A FacilityIdentifier/OperatorIdentifier with country: "" passes validation — live fail-open behavior today, not contingent on go-live timing.

3. Other required string fields aren't checked for emptiness

Location: src/registry/payload.rs:46-56
Issue: Beyond digital_link_url, sector, schema_version, and OperatorIdentifier.name can all be empty and validate() still returns Ok(()).
Failure scenario: An empty sector silently bypasses the one place meant to catch it before EU registry submission.