Activate a bounded federation capability-exchange canary

Creates a read-only canary for an already active verified_federation relationship, bound to the exact owner-authorized 24-hour starts_at and ends_at window. The server fixes the maximum at two paired refreshes (four HTTPS GETs to the bound origin) with at least six hours between refreshes; callers cannot supply URLs, limits, duration, or operational authority. A paused canary can resume only with the exact same immutable window; after revocation or expiry, the same relationship and owner-approval reference cannot create a fresh budget. The canary may open only the existing public-safe capability feed and grants no execution, routing, referral, payment, credential, private-data, trust/listing mutation, or partnership authority.