turbodocx-sdk skill: identityAssertion on non-external_idv recipients is rejected, not ignored

What's wrong

The JavaScript and Go references say an identity assertion passed for an OTP, override, or no-verification recipient is ignored. The backend rejects it: createSigningUrl returns a 400 with type IdentityModeConflict ("An identity assertion is not valid for this recipient").

Evidence

• skills/turbodocx-sdk/references/javascript.md:423: "OTP, override, and no-verification recipients ignore it."
• skills/turbodocx-sdk/references/go.md:496: same sentence.
• RapidDocxBackend src/handlers/TurboSign/createSigningUrl.ts:299-303 throws IdentityModeConflict when mode !== external_idv && params.identityAssertion. The code comment says this is deliberate: silently ignoring it would let an integrator believe the vendor check ran. Covered by createSigningUrl.test.ts:256 and :668.
• The Python, PHP, Java and Ruby references don't make this claim.

Impact

An agent following the skill may pass the same assertion for every recipient, thinking it's harmless, and every signing-URL mint for an OTP, override, or plain recipient then fails with a 400.

Suggested fix

In both files, replace the sentence with: "Pass it only for external_idv recipients. Sending it for an OTP, override, or no-verification recipient is rejected with a 400 IdentityModeConflict error." Optionally add the same line to the other four language references and an eval assertion.

Severity: S3. Found while auditing claims for the YouTube how-to series (external IdV video), verified against backend origin/master.