feat(federation): admission control on worker registration (S10)

Register() previously trusted a self-declared id and self-chosen token
from any caller, and let a second caller silently hijack an existing
worker id by re-registering it with a different token. Adds an optional
pre-shared AdmitToken (ORCHESTRA_FEDERATION_ADMIT_TOKEN) and requires a
same-id re-registration to present the existing worker's own token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

cmd/orchestra/main.go

@@ -128,7 +128,7 @@ func main() {
 		}
 	}
 	mux := http.NewServeMux()
-	workers := &federation.Registry{}
+	workers := &federation.Registry{AdmitToken: os.Getenv("ORCHESTRA_FEDERATION_ADMIT_TOKEN")}
 	workers.OnOffline = func(w federation.Worker) {
 		for _, t := range s.Tasks() {
 			if t.State == domain.StateLeased && t.Lease != nil && t.Lease.HarnessID == w.ID {
@@ -703,8 +703,13 @@ func main() {
 			http.Error(w, "token required", 400)
 			return
 		}
-		if err := workers.Register(worker); err != nil {
-			http.Error(w, err.Error(), 400)
+		admitToken := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if err := workers.Register(worker, admitToken); err != nil {
+			status := 400
+			if err == federation.ErrUnauthorized {
+				status = 401
+			}
+			http.Error(w, err.Error(), status)
 			return
 		}
 		w.WriteHeader(http.StatusCreated)