#22413 Bind Cloud dial tokens to the current install authority

Cloud token mints now recheck the original install authority after signing and include its opaque incarnation in the credential. The Native verification contract rejects mismatched identity, policy, issuer and service claims before spending a token.

Hosted checks pass: 523 selected cases (25 new) and the full backend suite (1,073 API cases). The receiving listener and live policy/keyset driver remain follow-ups. Builds on #22410.

Changelog

Fixed Cloud dial credentials losing their original install authority.