feat: mutual Realm peer handshake over TCP (0.9.11)

Exchange enrolled certificates and Ed25519 challenge signatures so
same-Realm instances can authenticate each other after discovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

CMakeLists.txt

@@ -123,6 +123,7 @@ set(CST_CORE_SOURCES
   src/worktree.c
   src/realm.c
   src/discover.c
+  src/peer_auth.c
   src/attach.c
   src/clipboard.c
   src/pdf_text.c
@@ -388,7 +389,7 @@ set(_CST_CORE_TESTS test_llm_body test_prefix_stable test_sse_decode
     test_undo test_config test_models test_model_registry test_sandbox
     test_keymap test_shell_compact test_skills
     test_plugins test_mcp test_subagent test_runtime test_realm test_discover
-    test_lowil
+    test_peer_auth test_lowil
     test_win_utf8 test_os_dir test_tmpdir
     test_tool_meta test_embed)
 if(CST_BUILD_WEBUI)