feat(auth): install runtime status and session conformance

[cea-block]

Why

Production status reachability and session conformance must share one runtime boundary so every protected entrypoint consumes exactly one validated, provider-neutral evidence object and fails closed otherwise. The final stacked migration range must remain linear after the owning authority repair.

What

• Persist current client-status projections and withdrawals, and expose authenticated production status and discovery.
• Install the provider-neutral verified-evidence resolver across protected production routes; absent, duplicate, conflicting, or unverified evidence denies.
• Keep JWT support as an optional provider profile rather than a mandatory runtime dependency.
• Enforce lease finalization, revocation, invalidation, delegated-relationship revision, and session non-reuse fences.
• Keep the EF migration range linear across 0043_client_status_fanout_withdrawals.sql, 0044_identity_public_projection_retirement.sql, and 0045_authorization_delegated_relationship_selector.sql.

Risk Assessment

Medium. The runtime seam is fail closed and provider neutral; defaults remain disabled. This draft does not deploy or activate enforcement.

References

• Three-PR stack: feat(db): add durable identity binding lifecycle #4772 → feat(auth): harden trusted evidence and protected objects #4783 (O4AB) → feat(auth): enforce protected routing and fail-safe invalidation #4789 (O4CD) → feat(auth): install runtime status and session conformance #4790 (O4EF).
• Exact base: cea/o4-invalidation-failsafe at 2b8e29ecbf686ecb00433f2109144be697368f68.
• Exact head: cea/o4-client-production at 22e91e6e6956426da9a30154a89403046c5549fd (tree 9e61f46fc6de893581a3fd44d7250d5b205c5c7e).
• Gate status: the stacked repair passed gap-free migrations 0001–0045, targeted formatting, whitespace, disclosure, scope, and DCO checks. Replacement CI: https://github.com/block/buzz/actions/runs/30962185171.

Generated with Codex