identity: pushed authorization requests (PAR, RFC 9126, +7 tests)

push_authorization_request lodges the authorization params under a
single-use request_uri; authorize_pushed redeems it into the normal consent
flow. Pushed requests reuse the pending store ({pushed, Rec} keyed by the
request_uri ref — distinct from consent req_ids, so no collision and no new
loop state). The pushed binding (client + redirect + PKCE) is still enforced
at exchange. New tests/par.sx. 217/217.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/conformance.sh

@@ -47,6 +47,7 @@ SUITES=(
   "session-mgmt|id-smgmt-test-pass|id-smgmt-test-count"
   "exchange|id-xchg-test-pass|id-xchg-test-count"
   "introspect|id-intr-test-pass|id-intr-test-count"
+  "par|id-par-test-pass|id-par-test-count"
 )
 
 cat > "$TMPFILE" << 'EPOCHS'
@@ -89,6 +90,7 @@ cat > "$TMPFILE" << 'EPOCHS'
 (load "lib/identity/tests/session_mgmt.sx")
 (load "lib/identity/tests/exchange.sx")
 (load "lib/identity/tests/introspect.sx")
+(load "lib/identity/tests/par.sx")
 (epoch 100)
 (eval "(list id-session-test-pass id-session-test-count)")
 (epoch 101)
@@ -127,6 +129,8 @@ cat > "$TMPFILE" << 'EPOCHS'
 (eval "(list id-xchg-test-pass id-xchg-test-count)")
 (epoch 118)
 (eval "(list id-intr-test-pass id-intr-test-count)")
+(epoch 119)
+(eval "(list id-par-test-pass id-par-test-count)")
 EPOCHS
 
 timeout 600 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1