tony-nexartis: delegated_admission — evidence admission gated on human-anchored, cascade-revocable delegation grants (production port)

Description

The pitch.

### What this adds

A trust-layer plugin, `delegated_admission`, that gates reputation
evidence on a **live, unrevoked, scope-valid delegation grant anchored
to a human principal** — plus a Tier-1 scenario, four adversarial
validators, and a 60-test suite (Hypothesis properties, byzantine
inputs, flip test, byte-determinism).

The core rule: `report()` admits evidence into scoring only when the
reporter holds a delegation grant that (a) chains back to a trusted
principal (proof-of-human), (b) is unrevoked along its entire ancestor
chain, (c) covers the required scope, and (d) carries a fresh,
Ed25519-signed proof envelope whose SHA-256 hash matches
**byte-for-byte**. Everything else is quarantined — sybil swarms,
revoked descendants, scope escalators, and stale-proof replays never
touch the score.

Three artifacts:

- **Plugin:** `packages/nest-plugins-reference/nest_plugins_reference/trust/delegated_admission.py`
- **Scenario:** `scenarios/delegated_trust_market.yaml` (+ factory in
  `nest_core/scenarios_builtin/delegated_admission.py`)
- **Validators:** four `validate_delegated_*` functions registered
  under `VALIDATORS["delegated_admission"]`

Registered via the `nest.plugins.trust` entry point in
`pyproject.toml` **and** `_BUILTINS`.

### Why (motivation & threat model)

Every trust plugin in the reference set answers "how do I aggregate
what agents say about each other?" None answers the prior question:
**why is this agent allowed to say anything at all?** Any software
process can mint an identity and start emitting evidence; volume-based
aggregation (`score_average`) is defenseless against it — 20 sybils
outvote 8 honest reporters every time.

`delegated_admission` makes admission the primitive. Authority
originates with a *human* principal and flows down a delegation chain
that can only narrow: scope shrinks, TTL shortens, revocability can't
be discarded. Revocation cascades — kill a mid-chain grant and every
descendant dies with it (≤32 hops, cycle-safe). The human can always
pull the plug on the whole subtree.

This is not invented for the hackathon. It is a deterministic,
in-process port of the delegation-grant verifier that runs in
production on our open-source NANDA node (https://github.com/Nexartis/homeport,
`src/lib/server/delegation-grants.ts`), deployed across a live
CubiCube fleet. The port replaces every I/O seam with injected
deterministic parameters (logical clock, seeded keys) — the same move
that made #149's production port viable under the Tier-1 gate.

### Design

```
principal (human, fixture-signed Ed25519)          AdmissionPolicy
        │  PuhProof {principalPk, deviceDid,        trusted_principals
        │   requestId, boundAt, issuedAt, sig}      require_signed_puh=True
        ▼                                           puh_freshness_ms=300_000
grant(subject, proof, granted_by_proof_hash)        puh_skew_ms=30_000
  ├─ canonical envelope → SHA-256, byte-exact       required_scope
  ├─ freshness window vs injected now_ms
  ├─ Ed25519 verify over canonical bytes
  └─ chain-narrowing vs parent (scope ⊆, ttl ≤, revocable flip ban)
        │
revoke(id) ──► BFS cascade over children (≤32 hops, idempotent)
check(id)  ──► ancestor walk: revoked/expired parent kills child,
        │      expiry narrows to earliest ancestor bound
        ▼
async report(agent, evidence)
  admitted → score (same math as score_average)
  else     → quarantined with a stable machine reason
             (no-grant | revoked | scope-invalid | puh-proof-stale |
              proof-hash-mismatch | bad-signature | ...)
```

The canonical envelope is the load-bearing detail, ported byte-exactly
from the TS source (insertion-order JSON, only `scope.toolNames`
sorted/trimmed, `parentDelegationId: null` never omitted, seconds vs
milliseconds preserved) and **locked by a fixed test vector**: the test
asserts the exact canonical string and its SHA-256 hex, so any future
serialization drift fails loudly.

### Adversarial validators — th

…