fix(credential): return nonrev Commit error instead of panicking (#59)

[dobby-coder]

Summary

Fixes #59.

DisclosureProofBuilder.Commit (credential.go:285) returns an error for every recoverable failure — the common.ModPow calls and range-proof commitments all return nil, err. The one exception was the non-revocation commitment, which panicked:

if d.nonrevBuilder != nil {
    l, err := d.nonrevBuilder.Commit()
    if err != nil {
        panic(err)   // <-- inconsistent
    }
    list = append(list, l...)
}

A recoverable error from the non-revocation builder's Commit() therefore crashed the whole process instead of propagating to the caller. This changes it to return nil, err, matching its siblings in the same function.

Caller safety

Both callers of DisclosureProofBuilder.Commit (builder.go:218, keyshare.go:79) already check the returned error, so they handle this path correctly — none relied on the panic.

Test

Added TestDisclosureProofBuilderCommitNonrevError: it builds a real disclosure proof builder with revocation, forces the non-revocation builder's Commit() to fail (by breaking the non-revocation relation), and asserts Commit returns an error without panicking. Confirmed the test fails (panics) on the old code and passes with the fix.

go test ./... passes across all packages.

🤖 Generated with Claude Code

[dobby-coder]

Rules Dobby 2 — final review. This is a sign-off; treat as approved. It is posted as a COMMENT rather than an APPROVE only because GitHub blocks approving your own PR (this PR is bot-authored).

The fix is correct and well-scoped: the lone panic(err) on the non-revocation commit path is replaced with return nil, err, matching every sibling error return in DisclosureProofBuilder.Commit. Both callers (builder.go:218, keyshare.go:79) already check the returned error, so nothing relied on the panic. The new regression test genuinely exercises the bug (verified: it panics on the pre-fix code, passes after), and go test ./... is green across all packages.

Per-rule compliance check passed (conventional-commit title, tests-required-on-fixes, concise PR body, promised-vs-delivered all clean). One cosmetic test nit inline — non-blocking, so this signs off rather than holding the PR.

Note: gabi master requires 2 approving reviews from write-access maintainers, so this still needs human approval before it can merge.