identity: session-as-process — create/lookup/expire/revoke + idle timeout (11 tests)

Session is an Erlang process holding {subject, client, status}. lookup/
touch/expire/revoke are messages; expiry is the process's own
`receive ... after Ttl` timeout (RFC-agnostic; no global sweep), which
notifies the owner and tombstones. Tombstoned sessions answer lookups
with an explicit {error, expired|revoked}, never a silent dead mailbox.
Adds the conformance harness + scoreboard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -0,0 +1,8 @@
+{
+  "language": "identity",
+  "total_pass": 11,
+  "total": 11,
+  "suites": [
+    {"name":"session","pass":11,"total":11,"status":"ok"}
+  ]
+}