feat(auth): enforce caller credentials and trusted stream wakes

[NathanFlurry]

Summary

Complete the Durable Streams subscription stack with caller credential enforcement, trusted gateway wakes, and declarative actor routing. This PR is the stack tip; review from #21 upward.

Dependencies

• Engine JWT and signing stack: https://github.com/rivet-dev/engine-ee/pull/1166.
• Actor manifest, stream grants, and consumer integration: https://github.com/rivet-dev/engine-ee/pull/1354.
• CI conformance needs a compatible unreleased Engine build artifact URL and SHA-256 checksum.

Verification

cargo fmt --all -- --check passed. cargo test --lib: 54 passed, 1 Engine-dependent test skipped by its local setup. The full Engine-dependent conformance suite was not rerun for this submission.

[NathanFlurry]

Stack for rivet-dev/rivet-durable-streams

• #18 feat(auth): enforce caller credentials and trusted stream wa … 👈
• #20 docs(auth): require caller credentials for stream data reque …
• #19 feat(subscriptions): reconcile declarative actor stream rout …
• #17 feat(subscriptions): authenticate trusted Rivet gateway deli …
• #21 feat: add durable webhook and pull-wake subscriptions
• main

Get stack: forklift get 18
Push local edits: forklift submit
Merge when ready: forklift merge 18

_{change zltqvxrr}