AITrace-owned identifier policy for generated ids and imported aliases.
Generated ids keep the existing 32-character lowercase hex shape for API compatibility. Caller-supplied ids are accepted only as bounded external aliases so proof consumers can distinguish generated ids from imports.