federation.md: mcp's lab:peer half, as built

[Evanfeenstra]

Plan only, plans/federation.md. This note was pushed to #129 a few minutes after that PR merged, so it never reached main.

• §3, the lab:peer bullet: built in stakwork/stakgraph#1754, and how it turned out simpler than written.
  • labAuth takes a lab:peer JWT as Authorization: Bearer only, never ?key=, and the dictation socket refuses it.
  • labAuth stashes strut's peer scope for resolveScope. Strut, not labAuth, decides what a peer may do.
  • The actor is the token's sub, else the caller's x-strut-actor.
  • verifyApiToken accepts api unless told otherwise, so the token opens nothing outside /lab.
  • lab:read is not built.
• Step order, step 4: both halves are built, with Peers: a peer-scoped key that reads, launches, and controls only the runs a peer launched #129 for strut and stakgraph#1754 for mcp, which pins Peers: a peer-scoped key that reads, launches, and controls only the runs a peer launched #129's merge.