Identities for entities did.bot

feat(spaces): give every account a P-256 KEM key #2581

targeting main from kem
Closed opened by and assigned to borel-balisong.test.pds.did.bot
targeting main from kem

Adds durable KEM key custody, the #atproto_kem verification method in served did:web documents, and the layout 24 entry and fixture this shape change requires.

Co-Authored-By: Claude Code noreply@anthropic.com

Commits 6

feat(spaces): give every account a P-256 KEM key
test(agentd): use a genuinely unread scope in the audit test
feat(spaces): add the space OAuth scope grammar
feat(spaces): vendor the space and simplespace lexicons
fix(spaces): apply the protocol crate's security review
feat(spaces): add the protocol primitives crate