feat(distribution): carry typed authority through remote spawn

[dporkka]

Depends on

• refactor(authority): keep external authority typed through actor runtime #398 refactor(authority): keep external authority typed through actor runtime

Summary

• allow spawn@node ... with [...] to preserve exact spawn-site external authority through MIR, bytecode metadata, VM dispatch, and the distributed runtime
• validate requested remote authority as an exact subset of the executing parent actor before creating a placeholder or emitting a packet
• add Packet::SpawnRequestAuth on unused NUL0 packet type 17 for authority-bearing remote spawns
• preserve the frozen type-3 SpawnRequest byte layout for empty-authority spawns
• decode authority tokens fail-closed into AuthorityManifest before remote actor creation and reject malformed, duplicate/non-canonical, oversized, or trailing authority encodings
• install exactly the delegated manifest on the receiving actor
• apply the same wire-safe initial-state restrictions to legacy and authority-aware spawn packets

Wire compatibility

NUL0 WIRE_VERSION remains 1. No existing packet layout is changed. Empty-authority remote spawn still uses the frozen type-3 SpawnRequest; authority-bearing spawn uses additive packet type 17. Older peers therefore never reinterpret new bytes under the legacy layout.

Security model

• no grant means no external authority
• sender-side delegation is monotonic: a child cannot receive a grant the executing parent does not hold
• denied delegation happens before placeholder allocation or network emission
• the receiver validates the complete canonical manifest before actor creation
• actor runtime state remains typed (AuthorityManifest), not stringly typed
• the accepted/authenticated cluster node is currently the trust boundary for its sender-side delegation check; cryptographic per-actor delegation proofs are intentionally out of scope

Coverage

• compiler regression verifies RSpawn records exact spawn-PC authority metadata
• packet roundtrip verifies type-17 canonical authority encoding
• malformed authority bytes fail at packet decode
• authority-aware spawn initial state uses the same wire-safety gate as legacy spawn
• two-node integration verifies exact manifest installation on the remote actor
• two-node integration verifies attempted authority escalation creates neither a placeholder nor a remote child

Validation

Static compile-oriented review completed across packet enum exhaustiveness, VM callback signatures, tcp feature gates, NUL0 version constants, payload safety, and runtime exports. Local Cargo execution is unavailable in this environment because repository cloning cannot resolve github.com; GitHub CI is the executable validation gate.

Draft until #398 and this stacked PR pass CI.

[cloudflare-workers-and-pages]

Deploying nulang-docs with    Cloudflare Pages

Latest commit:	276ab98
Status:	✅  Deploy successful!
Preview URL:	https://3c4966de.nulang-docs.pages.dev
Branch Preview URL:	https://semantic-closure-distributed.nulang-docs.pages.dev

View logs