feat: add durable webhook and pull-wake subscriptions

[NathanFlurry]

Summary

Add durable webhook and pull-wake subscriptions, persisted cursors and recovery, Engine-issued application capabilities, and Engine-owned webhook signing/JWKS. The secured test harness provisions namespace-scoped JWT grants through OSS Engine. This is the base of the Durable Streams stack and depends on OSS signing #5878 and RivetKit streams #5877.

CI builds the pinned OSS Engine revision when no compatible released artifact is configured. Private ACL provisioning is absent.

Validation

• Local secured conformance: 365/365 passed on the final code, including the fork TTL and live SSE close regressions.
• Rust create/append/read/SSE/delete and 4096-stream persistence tests pass.
• Crash/restart recovery passes, including signing key continuity, wake replay, claim fencing, source recreation, and tenant isolation.
• A named RivetKit actor received a signed wake and processed the stream event end to end.
• GitHub CI builds the pinned OSS Engine revision and runs the same secured suite.

[NathanFlurry]

Stack for rivet-dev/rivet-durable-streams

• #18 feat(auth): enforce caller credentials and trusted stream wa …
• #20 docs(auth): require caller credentials for stream data reque …
• #19 feat(subscriptions): reconcile declarative actor stream rout …
• #17 feat(subscriptions): authenticate trusted Rivet gateway deli …
• #21 feat: add durable webhook and pull-wake subscriptions 👈
• main

Get stack: forklift get 21
Push local edits: forklift submit
Merge when ready: forklift merge 21

_{change tlsollqw}