Add opt-in delegated dispatch and durable custody library

[jmcentire]

Adds an opt-in Python library for delegated provider dispatch with opaque custody references. No CLI command, default configuration, or adapter enables this path automatically. Callers supply a trusted authorization verifier and custody-internal operation factory; the SQLite constructor provides a single-node durable reference implementation.

The runtime binds dispatch and custody to one verified authorization, exact request fingerprint, audience/workload/purpose/policy context, enabled connector ceiling, single-use authorization, and bounded provider-attempt budget. Durable claims and consumption reservations retain budgets across recovery. Sanitized outcomes, audit events, and an acknowledgeable failure queue provide local operational evidence.

Review fixes recheck authorization validity before and after reserving each provider attempt, evaluate journal lease time after obtaining the SQLite write lock, enforce exact handle connector identities, and reject non-integer authorization budgets. Regression tests reproduced the validity, contention, handle-binding, and malformed-budget defects before the fixes.

Validation: 91 focused custody/runtime/connector/Signet-adapter tests and the full 1,186-test Python 3.12 suite passed. Changed-module/test Ruff, CRLF-aware diff validation, and isolated sdist/wheel build passed. Hosted checks are attached to the current head.

Deployment prerequisites remain explicit in docs/credential-custody-boundary.md: concrete trusted verifier transport and issuer/rotation policy enforcement, custody provider backend, provider idempotency/reconciliation, external audit and alert operation, plus HA persistence/shared circuit policy when required by the deployment. The library's local reference tests establish none of those external capabilities. No provider credentials, signing keys, or live provider calls were used.

Supersedes the closed overlapping drafts #13 and #16.

[jmcentire]

Reconciliation update at 06107d4:

• Rebased the full delegated-custody runtime onto current main (15ee52d) with no conflicts.
• Added the Signet/Baton contract ceilings missing from this draft: configured trusted ceilings bounded by hard limits of 3 provider attempts and 15 minutes, sent to the Signet verifier and rechecked against both adapter and custom verifier results.
• Added rejection coverage for over-budget and overlong authorizations.

Verification:

• 82 focused delegated runtime, connector, custody, and Signet adapter tests passed.
• Changed-surface Ruff, Python compilation, package build, and git diff --check passed.
• Full-suite execution is currently blocked by a pre-existing origin/main regression: tests/test_cli.py::TestCmdRouteSetRemote::test_returns_1_when_remote_unreachable lets its mocked OSError escape. The same test fails unchanged at origin/main; a separate repair is being prepared.

This remains a draft: it is executable reference evidence, not authorization to merge or deploy the production provider path described in the remaining-dependencies section.

[jmcentire]

Final current-main verification update at 57d8fd5:

• Rebased again onto Baton main after fix(cli): handle unreachable remote route control #23 restored remote-route error handling.
• The full Baton PYTHONPATH=src python -m pytest -q suite now passes.
• Changed-surface Ruff, Python compilation, package build, and git diff --check pass.

#17 remains a draft by design. Its production gates remain unresolved: a concrete trusted Signet verifier transport, HA durable journal/ledger, custody-internal provider backend, externally anchored audit and failure-notification operations, provider idempotency/reconciliation, shared circuit state, and Signet key-free cryptographic evidence. Do not merge or integrate it into MEA until those gates are separately satisfied.