Accept remote federation evidence and issue key-control challenge

Gate 1 owner-gated federation identity-resolution accept. Disabled unless AGENT_FEDERATION_IDENTITY_WIRING_ENABLED=true. Approves an existing trap-scanned evidence row, pins only the full SPKI key already stored on that evidence row, and issues a durable challenge whose signed payload includes remote_origin. This proves no independent partner identity and does not by itself promote verified_federation; a later challenge response must verify key control. The route does not accept request-body key material, send A2A messages, execute providers, spend, settle, or mutate marketplace/listing trust.