fed-sx-m2: Step 10a — discovery primitives + 12 tests

New next/kernel/discovery.erl with the local-side webfinger
primitives per design §13.7:

  parse_acct/1(Bin) -> {ok, User, Host} | {error, _}
    Accepts <<acct:user@host>> (with prefix) or <<user@host>>
    (bare). Host preserves an optional :port suffix. Rejects
    empty user/host and missing @.

  parse_resource/1   alias for the webfinger ?resource= shape

  actor_url_for/2(User, Host)
    Synthesises <<http://<host>/actors/<user>>>. TLS / https
    is v3, gated on a TLS substrate Blocker.

  webfinger_body/3(User, Host, ActorUrl)
    Builds the RFC 7033 JSON body:
      {"subject":"acct:<user>@<host>",
       "links":[{"rel":"self",
                 "type":"application/activity+json",
                 "href":"<actor_url>"}]}
    Hand-rolled byte concatenation — no JSON BIF on this port.

Substrate gotcha re-confirmed: <<"acct:">> string literals
truncate to one byte on this port. "acct:" is spelled as
<<97,99,99,116,58>> in the implementation.

12/12 in next/tests/discovery.sh covering:
  - parse_acct prefixed + bare forms
  - host with :port preserved
  - reject empty user / missing @ / empty host
  - parse_resource alias
  - actor_url_for synthesis + port preservation
  - webfinger_body prefix shape + byte_size sanity

Step 10b (http_server route GET /.well-known/webfinger) and
Step 10c (peer-actor fetch via Step 5's lookup_or_fetch slot)
layer on top. 10c gates on Blockers #2 (native http-request
primitive missing).

plans/fed-sx-milestone-2.md

@@ -654,13 +654,33 @@ Per §13.7: webfinger plus actor doc fetch.
 
 **Deliverables:**
 
-- `GET /.well-known/webfinger?resource=acct:alice@<host>` returns the
-  actor URL.
-- `GET /actors/<id>` returns the actor doc (already exists from
-  M1 Step 8c-actors).
-- Peer-actor cache: when verifying a peer's signature for the first
-  time, fetch their actor doc, store in `peer-actors` projection.
-- `discovery:resolve/1("acct:alice@host:port")` returns the actor URL.
+- [x] **10a** — Local-side discovery primitives in
+  `next/kernel/discovery.erl`:
+  - `parse_acct/1(<<"acct:user@host">>)` and
+    `parse_acct/1(<<"user@host">>)` (prefix optional) return
+    `{ok, User, Host}` or `{error, _}`. Reject empty user/host
+    and missing `@`. Host preserves an optional `:port` suffix.
+  - `parse_resource/1` is an alias for the webfinger query
+    parameter shape.
+  - `actor_url_for/2(User, Host)` synthesises
+    `http://<host>/actors/<user>` (TLS / https is v3, gated by
+    a TLS substrate Blocker).
+  - `webfinger_body/3(User, Host, ActorUrl)` builds the RFC 7033
+    JSON body with `:subject` + `:links[]` carrying
+    `rel: self / type: application/activity+json / href`.
+  Hand-rolled byte concatenation — no JSON BIF on this port.
+  `<<"...">>` string-literal segments truncate to one byte on
+  this port (briefing gotcha re-confirmed), so `"acct:"` is
+  spelled as `<<97,99,99,116,58>>`. 12/12 in `discovery.sh`.
+- [ ] **10b** — http_server route for
+  `GET /.well-known/webfinger?resource=acct:...`: parses the
+  query, looks up the actor via the kernel, returns 200 +
+  webfinger_body when known, 404 otherwise.
+- [ ] **10c** — Peer-actor fetch + cache write. Gates on
+  Blockers #2 (native `http-request` primitive missing).
+  Step 5's peer_actors cache already exposes the
+  `lookup_or_fetch` shape; this Step 10c plugs the discovery
+  HTTP fetch into the FetchFn slot.
 
 **Tests:**
 
@@ -950,6 +970,15 @@ proceed.
 
 Newest first.
 
+- **2026-06-07** — Step 10a: discovery primitives. New
+  `next/kernel/discovery.erl` parses acct: URIs
+  (prefix optional), synthesises `http://<host>/actors/<user>`,
+  and builds RFC 7033 webfinger JSON bodies. Hand-rolled byte
+  concatenation since this port has no JSON BIF and `<<"...">>`
+  string literals truncate to one byte (substrate gotcha). 12/12
+  in `discovery.sh`. The route wiring (10b) and peer-actor
+  fetch (10c) layer on top — 10c gates on Blockers #2.
+
 - **2026-06-07** — Step 8c: delivery-state projection. New
   `next/kernel/delivery_state.erl` folds enqueue / delivered /
   failed / dead_lettered events into a per-peer worker-shaped