identity: membership state machine + per-app grant projection (17 tests)

membership.sx — coop membership as a guarded state machine
(none→pending→active→lapsed⇄active, any→revoked terminal); invalid
transitions return explicit {error, CurrentStatus}, never silent no-ops.
project(Subject, App) renders the one canonical state into a per-app claim
({member,Tier,App} / {pending,App} / {lapsed,App} / {denied,App} /
{non_member,App}) — identity reports what the membership is; acl decides
whether the app should honour it. New tests/membership.sx. 92/92.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,13 +1,14 @@
 {
   "language": "identity",
-  "total_pass": 75,
-  "total": 75,
+  "total_pass": 92,
+  "total": 92,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":18,"total":18,"status":"ok"},
     {"name":"registry","pass":9,"total":9,"status":"ok"},
     {"name":"api","pass":10,"total":10,"status":"ok"},
     {"name":"oauth","pass":17,"total":17,"status":"ok"},
-    {"name":"sso","pass":10,"total":10,"status":"ok"}
+    {"name":"sso","pass":10,"total":10,"status":"ok"},
+    {"name":"membership","pass":17,"total":17,"status":"ok"}
   ]
 }