feat: password Realm, single-chair login, shared parliament context (0.9.12)

Derive Realm keys from a user password (Argon2id, no private key on disk).
Login claims the sole chair with handover; peers share parliament context;
--new-project clears it. CLI peer/discover helpers and Docker alpine recipe
included; headless empty-answer retries raised for unattended runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

CMakeLists.txt

@@ -124,6 +124,8 @@ set(CST_CORE_SOURCES
   src/realm.c
   src/discover.c
   src/peer_auth.c
+  src/parliament.c
+  src/parliament_cli.c
   src/attach.c
   src/clipboard.c
   src/pdf_text.c
@@ -389,7 +391,7 @@ set(_CST_CORE_TESTS test_llm_body test_prefix_stable test_sse_decode
     test_undo test_config test_models test_model_registry test_sandbox
     test_keymap test_shell_compact test_skills
     test_plugins test_mcp test_subagent test_runtime test_realm test_discover
-    test_peer_auth test_lowil
+    test_peer_auth test_parliament test_lowil
     test_win_utf8 test_os_dir test_tmpdir
     test_tool_meta test_embed)
 if(CST_BUILD_WEBUI)