identity: delegated grant-verification cache with generation invalidation (Phase 3 complete, +9)

cache.sx — a process wrapping the token registry, memoising introspect.
Revocation stays real via generation invalidation: any revoke/refresh bumps
a generation counter, so every cached positive instantly becomes a miss and
re-validates against the live registry. A revoked token never reads valid
out of cache, not for a millisecond. stats() exposes hits/misses. New
tests/cache.sx. 101/101.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 92,
-  "total": 92,
+  "total_pass": 101,
+  "total": 101,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":18,"total":18,"status":"ok"},
@@ -9,6 +9,7 @@
     {"name":"api","pass":10,"total":10,"status":"ok"},
     {"name":"oauth","pass":17,"total":17,"status":"ok"},
     {"name":"sso","pass":10,"total":10,"status":"ok"},
-    {"name":"membership","pass":17,"total":17,"status":"ok"}
+    {"name":"membership","pass":17,"total":17,"status":"ok"},
+    {"name":"cache","pass":9,"total":9,"status":"ok"}
   ]
 }