Refresh stored remote federation evidence

Gate 2 owner-gated evidence refresh. Disabled unless AGENT_FEDERATION_IDENTITY_WIRING_ENABLED=true. Re-fetches the original Agent Card through the SSRF-safe fetch boundary and stores a fresh reviewable evidence row under the existing relationship_id/remote_origin binding. If refresh fails, the active evidence exceeds max age, or the refreshed card/key differs from the active verified evidence, the route fails closed by revoking the active key-control pin and deactivating the verified_federation binding until fresh owner review. The route does not send A2A messages, execute providers, spend, settle, or promote trust by itself.