feat(delegation): RFC 8693 actor tokens + gateway/workload subjects.

[terylt]

Summary

Foundational slice for multi-principal delegation. A delegate(...) step can
now name whose identity the minted credential speaks for and who is
acting, covering the on-behalf-of, autonomous-agent, and gateway-as-itself
cases. More to come as we finish the remaining use cases.

What's here

• Subject selection — subject: user | client | caller_workload | gateway
  on a delegation step. The minted token's attribution (DelegationMode) is
  derived from the subject, never declared separately — so a route can't claim
  on-behalf-of-user while handing over a workload SVID.
• RFC 8693 actor tokens — actor: caller_workload attaches the caller's SVID
  as the actor_token, so the minted token records act alongside sub
  (validated and signed by the IdP).
• Gateway-as-subject — subject: gateway switches to a client_credentials
  grant (the gateway calls as itself); no inbound credential required.
• SPIFFE workload ingress — a role: caller_workload resolver validates
  JWT-SVIDs into caller_workload.*, stashed as TokenKind::SpiffeJwt;
  non-SPIFFE tokens are rejected.
• Cache-collision fix — DelegationKey now includes the calling workload, so
  tokens minted for one agent can't be served to another once cross-request
  caching lands.
• Rename — TokenRole::Workload → CallerWorkload (serde alias = "workload" keeps existing configs working), disambiguating the caller from
  the gateway.
• Docs — identity/delegation pages document the subject: / actor: keys
  and the three attributions.

Not in this PR (follow-ups)

• Gateway's own SVID as subject_token (subject: gateway +
  actor: caller_workload, so the backend sees both) — needs a gateway-credential
  source.
• Vault-backed delegation for downstreams that don't speak OAuth.

Verification

884 tests passing; fmt and clippy -D warnings clean. New behavior is covered
by e2e tests, each mutation-checked (broke the code, confirmed the test fails).