security(runtime): authorize direct effects through one validated caller context

[forkwright]

Finding

Akroasis has direct operator effects outside Praxis, but no single validated
caller-context contract. Calling an operation "authorized" is self-proving if
each domain invents a principal, token store, or policy interpretation.
Installation signing identity proves provenance, not human/effect authority.

Shared ownership boundary

• koinon is the stable dependency-leaf type home for one closed, versioned
  ValidatedCaller contract. Adding that later shared type does not reopen
  Phase 01 or transfer authorization policy there.
• The application request boundary resolves the type from authoritative local
  OS peer credentials/ACLs or an accepted service identity. Loopback is not
  identity. The resolver creates no second credential store.
• Phase 05 owns service/API authentication and request authorization into the
  resolver. Local IPC uses OS peer identity/ACLs; nonlocal identity consumes
  accepted Kryphos storage/certificate contracts.
• Every domain independently owns adoption and its effect-time
  capability/scope policy. Praxis owns automated-dispatch authority. Those
  integrations do not gate closure of this shared-contract issue.

Done when

• The closed, versioned caller type records principal source,
  authenticated identity reference, granted scope/capability, policy epoch,
  freshness/expiry, persona context when applicable, and revocation state
  without carrying a reusable secret.
• One application resolver derives local callers from authenticated OS
  peer credentials/ACLs and nonlocal callers from an accepted service identity;
  loopback alone is rejected, unknown resolver/type versions fail closed, and
  no fallback token/identity store exists.
• Generic fake-contract tests prove absent, unknown, untrusted, stale,
  expired, revoked, wrong-persona, and insufficient-scope contexts yield a
  typed denial before invoking a fake domain effect.
• The shared receipt contract carries only canonical caller/effect
  references, capability/policy/schema epoch, intent/outcome, and allowed
  digests. Raw device paths, frequencies, rules, payloads, content, keys, and
  credentials are unrepresentable.
• Injected resolver, audit, partial-call, restart, cancellation, and
  backpressure fixtures prove fail-closed propagation and an explicit recovery
  relation without hardware, host networking, firewall mutation, or production
  endpoints.

Domain adoption boundary

Radio, mesh, runtime lifecycle/offline, SDR, IDS, interface, Pinax, OSINT, and
Peira plans/issues own their own caller-context adoption and effect-policy
acceptance. They may close independently once this shared contract is accepted
and their local criteria pass. #400 owns collector lifecycle, #407 owns
connection inventory/offline orchestration, and #404 owns nftables
transactions; none of them moves into this issue.

No hardware or host mutation is authorized by this issue.