identity: token exchange — downscope into an independent token (RFC 8693, +8 tests)

oauth.sx gains token_exchange(SubjectToken, RequestedScope): a valid access
token is downscoped into a NEW independent grant for the same subject
(subset only, else invalid_scope; inactive subject token → invalid_grant).
The exchanged token's lifecycle is independent of the subject token
(revoking either leaves the other active); exchanges chain. Least-privilege
handoff to downstream services. New tests/exchange.sx. 201/201.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 193,
-  "total": 193,
+  "total_pass": 201,
+  "total": 201,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -19,6 +19,7 @@
     {"name":"device","pass":10,"total":10,"status":"ok"},
     {"name":"facade","pass":9,"total":9,"status":"ok"},
     {"name":"delegation","pass":8,"total":8,"status":"ok"},
-    {"name":"session-mgmt","pass":8,"total":8,"status":"ok"}
+    {"name":"session-mgmt","pass":8,"total":8,"status":"ok"},
+    {"name":"exchange","pass":8,"total":8,"status":"ok"}
   ]
 }