Add authenticated broker contract

[dovvnloading]

Summary

• add a transport-neutral, bounded authenticated broker frame contract
• enforce direction-specific HMAC keys, canonical broker messages, and authority-field rejection
• add trusted peer ACL/integrity/process binding and installation/job-owner authorization
• document the stage, evidence, failure categories, and the explicit native-transport/provider follow-up gate

Safety boundary

This PR does not create a named pipe, configure a DACL, query peer tokens, establish keys, spawn an executor, install a bundle, or enable a provider. Native transport, handshake, staging, sandbox, and provider work remain blocked behind separate review gates.

Validation

• python -m pytest -q — 155 passed (one pre-existing pytest-asyncio deprecation warning)
• python -m compileall -q backend\cortex_backend\execution tests
• python tools/generate_contracts.py
• git diff --check
• npm.cmd run lint --prefix frontend
• npm.cmd run typecheck --prefix frontend
• npm.cmd run build --prefix frontend
• npm.cmd test --prefix frontend -- --run — 39 passed