End receiving streams when authority expires or changes

Closed
TE
3h ago
+918-29

End authenticated streams on policy/key revocation or lease expiry, including daemon handoffs and SSH copies. Leases capture the current generation and peer authority; renewals preserve replay history.

83 Linux receiver tests (17 stream cases), fmt/Clippy and Rust 1.91 checks pass. macOS is queued. Listener and live policy-driver composition remain follow-ups.

Changelog

none