feat(authorityquorum): add distributed approval binding

[thinksyncs]

Summary

• Add a generic k-of-n authority approval binding for distributed brokers.

Changes

• Bind ASB-verified credentials and exact operation digests to stable authority slots.
• Add an atomic approval, revocation, and quorum-consume store contract with a concurrency-safe demo store.
• Add TLS-derived binding, strict JSON schema validation, security-focused tests, documentation, and a 2-of-3 demo.

Testing

• go test -race -count=1 ./pkg/authorityquorum/... ./schemas ./examples/authority-quorum-demo
• go test -race -count=20 ./pkg/authorityquorum/... with concurrency and expiry filters
• go vet ./pkg/authorityquorum/... ./schemas ./examples/authority-quorum-demo
• go mod verify
• go run ./examples/authority-quorum-demo
• git diff --check
• Codex Security diff review: no reportable findings

The repository-wide race test was also attempted. Existing tests that require local listeners, external network access, or sudo could not run in the sandbox.

Notes

• MemoryStore is demonstration-only. Production requires a shared durable transaction or linearizable CAS.
• This change distributes approval authority. Secret-share storage, reconstruction, and idempotent external release remain separate deployment responsibilities.