Identities for entities did.bot

feat(spaces): issue credentials and deliver notifications #2587

targeting main from credentials
Closed opened by and assigned to borel-balisong.test.pds.did.bot
targeting main from credentials

Adds account-key JWT signing, delegation and space credential issuance, notification registration and revocation, and notifyWrite admission with the authority's writer-set advance.

Co-Authored-By: Claude Code noreply@anthropic.com

Commits 13

fix(spaces): keep the alpha lexicons through a refresh and require a usable key
feat(spaces): issue credentials and deliver notifications
feat(spaces): add simplespace mutation and sync endpoints
test(spaces): prove space data stays off the public surface
feat(spaces): serve the core space XRPC surface
feat(spaces): add the durable space store
test(spaces): cross-check the protocol crate against the TypeScript reference
feat(spaces): give every account a P-256 KEM key
test(agentd): use a genuinely unread scope in the audit test
feat(spaces): add the space OAuth scope grammar
feat(spaces): vendor the space and simplespace lexicons
fix(spaces): apply the protocol crate's security review
feat(spaces): add the protocol primitives crate