CAD038: Lattice Authentication

Makes the merge step itself the security boundary — every incoming signed value is verified against its owner key (public key, Convex address, or DID) at O(delta) cost. You cannot inject data into a namespace you don't own, no matter what transport delivered it.