feat(federation): admission control on worker registration (S10)

Register() previously trusted a self-declared id and self-chosen token
from any caller, and let a second caller silently hijack an existing
worker id by re-registering it with a different token. Adds an optional
pre-shared AdmitToken (ORCHESTRA_FEDERATION_ADMIT_TOKEN) and requires a
same-id re-registration to present the existing worker's own token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

progress.md

@@ -245,7 +245,35 @@ Fixed so far:
   existing pattern rather than introducing a one-off test harness for one
   handler.
 
-Not yet started: Codex/opencode Stop-hook-equivalent scripts, S8–S11. See
+- **S9** — the coordinator's `Monitor` loop (30s ticker, `Coordinator.expire`)
+  and `main.go`'s own 1s reclaim ticker both called `Store.ExpireLeases`
+  independently. AUDIT.md filed this as "harmless — CAS rejects the loser,"
+  but the real effect was worse: the coordinator's `expire()` is the *only*
+  place that kills the herdr session/pane for an expired lease, and since the
+  1s ticker ran 30x more often it almost always expired the lease first,
+  leaving the coordinator's own `ExpireLeases` call with nothing left to
+  expire — so its pane-kill path silently never ran, orphaning herdr panes
+  past their TTL whenever a coordinator was configured. Fixed by having
+  `main.go`'s ticker skip `ExpireLeases` entirely when `coordinator != nil`
+  and defer reclaim to the coordinator's loop, keeping only `AssignPending`
+  as a periodic retry. No coordinator (e.g. no herdrs configured) still uses
+  the direct `ExpireLeases` path, since nothing else would reclaim leases in
+  that case.
+
+- **S10** — `federation.Registry.Register` accepted a self-declared `id` and
+  self-chosen `token` from any caller with no admission control, and
+  silently let a second caller re-register an existing worker id with a
+  *different* token, hijacking that worker's identity/capacity out from
+  under it. Added `Registry.AdmitToken` (a pre-shared secret, wired from
+  `ORCHESTRA_FEDERATION_ADMIT_TOKEN`, checked against the registration
+  request's `Authorization: Bearer` header in `main.go`) and a same-ID
+  re-registration now requires presenting the existing worker's own token.
+  Covered by `TestRegisterRequiresAdmitTokenAndOwnToken`
+  (`internal/federation/federation_test.go`): wrong admit token rejected,
+  correct admit token accepted, same-id-different-token rejected as a
+  hijack, same-id-same-token (legitimate restart) still succeeds.
+
+Not yet started: Codex/opencode Stop-hook-equivalent scripts, S8, S11. See
 `AUDIT.md` for the full plan.
 
 **Phase 0 done (2026-07-27):** this box has live TCP reachability to the real