identity: delegated grant-verification cache with generation invalidation (Phase 3 complete, +9)

cache.sx — a process wrapping the token registry, memoising introspect.
Revocation stays real via generation invalidation: any revoke/refresh bumps
a generation counter, so every cached positive instantly becomes a miss and
re-validates against the live registry. A revoked token never reads valid
out of cache, not for a millisecond. stats() exposes hits/misses. New
tests/cache.sx. 101/101.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 92 / 92 tests passing**
+**Total: 101 / 101 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -11,6 +11,7 @@
 | ✅ | oauth | 17 | 17 |
 | ✅ | sso | 10 | 10 |
 | ✅ | membership | 17 | 17 |
+| ✅ | cache | 9 | 9 |
 
 
 Generated by `lib/identity/conformance.sh`.