feat(identify): add Sony C2PA device attribution, verified (v0.6.3)

Adds Sony to _DEVICE_C2PA_PLATFORM, matching Sony's own `sony.sig` / `sony.cert`
C2PA assertion namespace (NOT bare "Sony", which is a common EXIF Make). Verified
against a real Sony-signed file (Sony PXW-Z300, signer "Sony Corporation") found
in the Security4Media/c2pa-video-player repo. The sample is video (MP4) -- our
ISOBMFF C2PA path detects it; Sony Alpha stills likely share the namespace.

Verified device set is now Leica, Nikon, Google Pixel, Sony, Truepic. Canon /
Samsung / Bria still have no public direct-download C2PA sample to verify.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_identify.py

@@ -360,6 +360,15 @@ class TestIdentifyC2paDevice:
         assert r.platform == "Google Pixel (camera, C2PA capture)"
         assert r.is_ai_generated is None  # camera capture, not AI
 
+    def test_sony_namespace_beats_bare_make(self, tmp_path: Path):
+        # Sony's own C2PA assertion namespace (sony.sig), not the bare "Sony"
+        # EXIF Make that appears on ordinary photos.
+        blob = b"\xff\xd8\xff\xe1 c2pa.claim jumbf Adobe Sony sony.sig.v1_1 \xff\xd9"
+        p = tmp_path / "sony_like.jpg"
+        p.write_bytes(blob)
+        r = identify(p, check_visible=False, check_invisible=False)
+        assert r.platform == "Sony (camera, C2PA capture)"
+
 
 # ── Open invisible watermark (SD/SDXL/FLUX) integration ─────────────