feat: add canonical identity and scoped auth contracts

[andrei-hasna]

Summary

• define the canonical agent identity contract and validation surface
• add a reusable scoped access-token contract with required sub, tenant, session, scopes, iat, nbf, exp, and jti claims
• verify configurable issuer, audience, tenant, scopes, asymmetric algorithm allowlists, lifetime bounds, hashed revocation, and session-family state
• publish revisioned public JWKS data with active, retiring, and revoked-key semantics plus rollback protection
• expose composable HTTP handlers for GET /.well-known/jwks.json and POST /v1/auth/verify
• expose identities auth jwks and identities auth verify; bearer tokens are read from a protected file descriptor, never argv
• reject private JWK material, symmetric/none algorithms, unknown or revoked keys, stale JWKS revisions, empty scopes, unknown/disabled sessions, and invalid temporal/tenant/scope constraints

Security boundary

Signing keys remain caller-supplied. Published JWKS contains public key material only. Revocation and session-family lookups use hashes. Verification responses return stable redacted errors without echoing bearer tokens.

Validation

Current head: 1739cab5d2b2f86aa903f878d54e0c4309adf834

• rebased onto origin/main at 85aa1f4
• bun run verify:release — passed: typecheck, 98 tests / 1219 assertions, vendor-kit verification, build
• focused auth tests — 14 tests / 55 assertions passed
• git diff --check origin/main...HEAD — passed
• gitleaks protect --staged --redact --verbose --exit-code 1 — no leaks
• gitleaks git --log-opts=origin/main..HEAD --redact --verbose --exit-code 1 — 4 commits scanned, no leaks

Non-terminal lifecycle boundary

This PR supplies the JWT/JWKS verification and issuance contract needed by Infinity, but the parent identity-lifecycle task is intentionally not terminal. Identities still needs authoritative user/login identifiers and storage, Argon2id password handling, atomic registration/first-admin creation, rotating refresh-token/session families with replay revocation, logout-all, disable/delete/recovery behavior, and the owning persistence migrations.

Those capabilities remain Identities-owned under task 1f8bfadf-6c56-4996-a820-814f553c0a3f. Infinity task 76cfbe9e-9d9c-4650-bd5f-d2df37164e79 will consume that canonical lifecycle API and must not create a competing identity store.

[andrei-hasna]

Implemented the two reconciled P1 fixes on exact prior head 1739cab5d2b2f86aa903f878d54e0c4309adf834.

• JWKS coherence: createIdentityAuthApi now fails construction unless publication and verification use the exact same IdentityJwksRegistry. The regression proves a revision-2 publication revoking old cannot be paired with a stale revision-1 verifier that still accepts an old token. Red before fix; green after.
• CLI isolation: the owner-only token-file negative test now invokes the CLI in a subprocess and asserts exit status 1, empty stderr, and the JSON error output. Before: CI=true bun test src/identity-auth.test.ts reported 11 pass / 0 fail and exited 1. After: the same command exits 0.

Verification on 2deab178c0d26ee3f1337823b4d9e73e70205503:

• CI=true bun test: 99 pass, 0 fail, exit 0
• bun run verify:release: typecheck + 99 tests + vendor-kit + build passed
• bun pm pack --dry-run --ignore-scripts: passed
• npm pack --dry-run --ignore-scripts: passed
• all 14 package export maps and 3 bin targets exist; all runtime exports import successfully
• staged and outgoing secret-pattern scans: clean

No merge, publish, or deploy performed. Fresh independent adversarial review remains with the coordinator before lifecycle completion.

[andrei-hasna]

GitHub CI run 30019893958 completed successfully for exact head 2deab178c0d26ee3f1337823b4d9e73e70205503.