chore: sync II spec to dfinity/internet-identity release-2026-08-07 (#341)

## Summary

Automated sync of the Internet Identity specification from
`dfinity/internet-identity`.

**Release:** `release-2026-08-07`  (pinned from `e646fe9` → `c78d1b99`)

**Changed upstream files:**
- `docs/vc-spec.md`
- `src/internet_identity/internet_identity.did`

- Ran `npm run sync:ii-spec` — regenerated
`docs/references/internet-identity-spec.md` and
`docs/references/verifiable-credentials-spec.md`
- Build passed ✓

## Checklist

- [ ] Review the diff to `docs/references/internet-identity-spec.md` for
content changes
- [ ] Review the diff to
`docs/references/verifiable-credentials-spec.md` for content changes
- [ ] Check for new absolute `internetcomputer.org` link patterns
(script exits non-zero if any were missed)
- [ ] Verify any renamed or restructured sections are reflected
correctly

## Sync recommendation

`sync from dfinity/internet-identity — docs/ii-spec.mdx,
docs/vc-spec.md, src/internet_identity/internet_identity.did`

Co-authored-by: pr-automation-bot-public[bot] <pr-automation-bot-public[bot]@users.noreply.github.com>

Author: pr-automation-bot-public[bot]

.sources/VERSIONS

@@ -62,4 +62,4 @@ motoko-core           v2.4.0
 cdk-rs                ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0  317f55c
 candid                2025-12-18  # candid v0.10.20, didc v0.5.4                2e4a2cf
 response-verification v3.1.0                                                    18c5a37
-internetidentity      release-2026-07-31                                         e646fe93
+internetidentity      release-2026-08-07                                         c78d1b99

.sources/internetidentity

@@ -9,7 +9,7 @@ sidebar:
 
 This section describes the (Candid) interface to be implemented by an issuer of verifiable credentials on the IC.
 This interface is used by the II-canister during attribute sharing flow (cf. [flow description](https://github.com/dfinity/wg-identity-authentication/blob/d2664795afe9cea40386804bdb1259a47e34540d/topics/attribute-sharing.md))
-An example implementation of the interface is given in [demos/vc_issuer](https://github.com/dfinity/internet-identity/tree/main/demos/vc_issuer).
+An example implementation of the interface is given in [dfinity/internet-identity-vc-demo-issuer](https://github.com/dfinity/internet-identity-vc-demo-issuer).
 
 The Candid interface is as follows, and the subsequent sections describe the
 services and the corresponding messages in more detail.

docs/references/verifiable-credentials-spec.md

@@ -259,19 +259,6 @@ type CaptchaConfig = record {
     };
 };
 
-// One entry of the `sso_credential_migration` backfill. Maps the
-// (iss, aud) pair of a stored SSO credential to the discovery domain and
-// optional human-readable name it resolves to.
-type SsoCredentialMigrationEntry = record {
-    discovery_domain : text;
-    // Matches the stored credential's `iss`.
-    issuer : text;
-    // Matches the stored credential's `aud`.
-    client_id : text;
-    // Human-readable SSO label; stamped onto the credential's `sso_name`.
-    name : opt text;
-};
-
 // Init arguments of II which can be supplied on install and upgrade.
 //
 // Each field is wrapped is `opt` to indicate whether the field should
@@ -312,13 +299,6 @@ type InternetIdentityInit = record {
     // `https` for every discovery host. Never enable in production — non-loopback
     // hosts always require `https` regardless.
     sso_allow_insecure_discovery : opt bool;
-    // One-shot backfill of the `sso_domain` / `sso_name` fields on stored
-    // OpenID credentials. When set, a batched timer-driven migration stamps
-    // every stored credential whose (iss, aud) matches an entry and whose
-    // `sso_domain` is not set yet. Idempotent — already-stamped credentials
-    // are skipped, so re-submitting (e.g. with a corrected list) is safe.
-    // When unset, no backfill runs.
-    sso_credential_migration : opt vec SsoCredentialMigrationEntry;
     // Configuration for Web Analytics
     analytics_config : opt opt AnalyticsConfig;
     // Configuration to show dapps explorer or not
@@ -354,12 +334,6 @@ type InternetIdentityInit = record {
     // set/clear pattern as `dnssec_config`: null keeps the previously stored
     // value, `opt null` clears it, `opt opt "https://..."` sets it.
     mcp_official_url : opt opt text;
-    // One-shot upgrade arg driving the MCP config migration: `opt true` gives
-    // every anchor "enabled, official connector", since neither a value stored
-    // before the official connector existed nor an absent config was ever a
-    // choice about it. Unset means no migration, and the migration is refused
-    // when the deployment ships no `mcp_official_url`.
-    mcp_config_migration : opt bool;
 };
 
 // DNSSEC trust-anchor list. Any feature that needs DNSSEC-verified DNS
@@ -501,6 +475,9 @@ type SsoDiscovery = record {
     name : opt text;
     // Client the target origin runs its ceremony against; `null` when denied.
     resolved_client_id : opt text;
+    // How long a sign-in through this domain stays valid, in nanoseconds, from
+    // the domain's optional `session_max_age_seconds` (8 hours when unset).
+    session_max_age_ns : nat64;
 };
 
 // Status of a domain's SSO discovery, read by `get_sso_discovery_status`. A