acl: Phase 4 federation (trust-gated delegation, revocation) + 31 tests

federation.sx adds peer/trust/delegate/level_covers facts and one engine
rule: delegated grants apply only when local trust covers the action,
re-checked every query (non-transitive, fail-safe). Local/inherited deny
overrides federated grants; delegation composes with group and resource
inheritance. acl-revoke!/acl-fed-assert! propagate retraction/assertion;
mock fed-sx transport for tests. Federated proofs reconstruct via the
existing explainer. Roadmap complete: 120/120.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/conformance.conf

@@ -19,6 +19,7 @@ PRELOADS=(
   lib/acl/engine.sx
   lib/acl/explain.sx
   lib/acl/audit.sx
+  lib/acl/federation.sx
   lib/acl/api.sx
 )
 
@@ -26,4 +27,5 @@ SUITES=(
   "direct:lib/acl/tests/direct.sx:(acl-direct-tests-run!)"
   "inherit:lib/acl/tests/inherit.sx:(acl-inherit-tests-run!)"
   "explain:lib/acl/tests/explain.sx:(acl-explain-tests-run!)"
+  "fed:lib/acl/tests/fed.sx:(acl-fed-tests-run!)"
 )