identity: token exchange — downscope into an independent token (RFC 8693, +8 tests)

oauth.sx gains token_exchange(SubjectToken, RequestedScope): a valid access
token is downscoped into a NEW independent grant for the same subject
(subset only, else invalid_scope; inactive subject token → invalid_grant).
The exchanged token's lifecycle is independent of the subject token
(revoking either leaves the other active); exchanges chain. Least-privilege
handoff to downstream services. New tests/exchange.sx. 201/201.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 193 / 193 tests passing**
+**Total: 201 / 201 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -21,6 +21,7 @@
 | ✅ | facade | 9 | 9 |
 | ✅ | delegation | 8 | 8 |
 | ✅ | session-mgmt | 8 | 8 |
+| ✅ | exchange | 8 | 8 |
 
 
 Generated by `lib/identity/conformance.sh`.