[Hackathon] theritwik: delegatable capability tokens with cascading revocation

[theritwik]

Problem

Implements hackathon problem #4 (docs/hackathon/problems/04-auth-capability-delegation.md):
delegatable capability tokens with cascading revocation for the auth layer.

What this adds

• Plugin auth/delegatable.py — macaroon-style HMAC chaining (Birgisson et al., 2014).
  delegate(parent_token, audience, scopes_subset, ttl) mints a narrower, time-bounded
  sub-token without the issuer's secret; child scopes must be a subset of the parent's
  (else ScopeEscalationError), child expiry is clamped to the parent's.
  verify_presented(token, presenter) adds audience binding. Revoking any ancestor fails
  every descendant at the next verify (RevokedAncestorError) — cascading by construction.
• Adversarial validator validators/auth_validators.py — three pure checks: scope
  escalation, stale/revoked ancestor, audience confusion. FAILS against the reference
  jwt plugin, PASSES against delegatable (proven in tests).
• Scenario scenarios/delegated_auth.yaml — 16-agent delegation tree (1 coordinator,
  3 intermediaries, 12 leaves). Mid-run one intermediary is revoked; exactly its 4 leaves
  fail with RevokedAncestorError, the other 8 keep verifying. Deterministic under seeds
  42, 7, 1337.
• Tests — 30 new: unit, Hypothesis property tests, forged-token defenses (validly-signed
  scope-widening and ttl-extension rejected at verify), validator discrimination, and
  full-simulator integration.
• Registered as ("auth", "delegatable") builtin + nest.plugins.auth entry point;
  docs in docs/layers/auth.md.

Determinism

Token ids are content hashes, signatures are HMAC-SHA256 over canonical JSON, expiry uses
a logical tick clock — no wall time, no unseeded RNG.

Verify

make ci-local
# or just the new tests:
uv run pytest packages/nest-plugins-reference/tests/test_delegatable_auth.py \
              packages/nest-plugins-reference/tests/test_delegated_auth_scenario.py -v

All five CI commands exit 0 locally (ruff check, ruff format --check, pyright strict,
pytest: 766 passed).

[theritwik]

CI appears to be awaiting first-time-contributor approval — could a maintainer approve the workflow run? All five checks (ruff, format, pyright, pytest) pass locally via make ci-local.