acl: Phase 4 federation (trust-gated delegation, revocation) + 31 tests

federation.sx adds peer/trust/delegate/level_covers facts and one engine
rule: delegated grants apply only when local trust covers the action,
re-checked every query (non-transitive, fail-safe). Local/inherited deny
overrides federated grants; delegation composes with group and resource
inheritance. acl-revoke!/acl-fed-assert! propagate retraction/assertion;
mock fed-sx transport for tests. Federated proofs reconstruct via the
existing explainer. Roadmap complete: 120/120.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/scoreboard.json

@@ -1,12 +1,13 @@
 {
   "lang": "acl",
-  "total_passed": 89,
+  "total_passed": 120,
   "total_failed": 0,
-  "total": 89,
+  "total": 120,
   "suites": [
     {"name":"direct","passed":24,"failed":0,"total":24},
     {"name":"inherit","passed":30,"failed":0,"total":30},
-    {"name":"explain","passed":35,"failed":0,"total":35}
+    {"name":"explain","passed":35,"failed":0,"total":35},
+    {"name":"fed","passed":31,"failed":0,"total":31}
   ],
-  "generated": "2026-06-06T16:46:37+00:00"
+  "generated": "2026-06-06T16:53:44+00:00"
 }