identity: silent SSO prompt=none fast-path — one session, many clients (10 tests)

oauth.sx now owns a session registry. establish creates a subject session;
silent_authorize (OIDC prompt=none §3.1.2.1) asks "does this subject have a
live session?" — if yes it mints a code skipping consent, bound to client +
redirect_uri + PKCE exactly like a consented code; if no it returns
login_required (a negative state, not a login redirect). One session serves
many clients; end_session closes the fast-path. New tests/sso.sx. 75/75.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 65 / 65 tests passing**
+**Total: 75 / 75 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -9,6 +9,7 @@
 | ✅ | registry | 9 | 9 |
 | ✅ | api | 10 | 10 |
 | ✅ | oauth | 17 | 17 |
+| ✅ | sso | 10 | 10 |
 
 
 Generated by `lib/identity/conformance.sh`.