Support CEG/RET-native transport + CEG-attestation auth (proxy retirement path; reconcile Veilid→RET)

[emooreatx]

Support CEG/RET-native transport + CEG-attestation auth (the retirement path)

CIRISProxy is described in its own README as temporary bridging infrastructure designed to be retired as the decentralized network matures. The CIRIS Agent's federation/transport substrate is now CEG over Reticulum (RET) via CIRISEdge (edge 1.3.0 in-app today), not Veilid — so the concrete retirement path for the proxy is CEG/RET-native access, and the README's "Veilid" framing should be reconciled to RET.

What "CEG/RET native" means for the proxy

Today: Agent (mobile) --HTTPS--> CIRISProxy --> LLM providers, authenticated by Google OAuth + per-interaction CIRISBilling credit, keys server-side.

Target: the agent reaches LLM access over CEG/RET native transport, authenticated by CEG attestations at the trust boundary instead of Google OAuth:

1. RET transport ingress — accept Reticulum links (the agent already runs an Edge identity / signer_key_id), not only HTTPS.
2. CEG-attestation auth — verify a signed CEG attestation (agent identity + billing entitlement) at the boundary in place of an OAuth bearer. Billing entitlement becomes a CEG-native object the proxy reads, rather than an OAuth-scoped credit lookup.
3. CEG-native observability — the existing CIRISLens structured-event stream emitted as CEG attestations (consistent with the agent-side LensCore fold landing in 2.9.6).

Why now (gating + alignment)

• The agent-side attestation write/promote surface is CIRISPersist#171 (gating dep for CIRISAgent#840, the CEG-native agent). Proxy-side CEG-attestation auth consumes the same federation_attestations contract.
• This is a survey + scoping ticket (CIRISProxy currently has 0 open issues) to get the retirement path on record and reconcile the Veilid→RET framing. No agent-side change is requested here yet; the proxy can scope its RET ingress + attestation-verify boundary in parallel with the 2.9.6 substrate triple.

Non-goals

• Not asking to drop HTTPS/OAuth in 2.9.6 — CEG/RET native runs alongside the existing bridge until parity, then the bridge retires.
• No conversation retention change (zero-retention stays).

Cross-refs: CIRISAgent#840 (CEG-native agent), CIRISPersist#171 (attestation surface), CIRISAgent 2.9.6 LensCore fold.