feat: mutual Realm peer handshake over TCP (0.9.11)

Exchange enrolled certificates and Ed25519 challenge signatures so
same-Realm instances can authenticate each other after discovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

Makefile

@@ -106,6 +106,7 @@ CORE_SRC = \
 	src/extensions.c src/plugins.c src/mcp.c src/subagent.c src/attach.c src/clipboard.c \
 	src/pdf_text.c \
 	src/session.c src/runtime.c src/worktree.c src/realm.c src/discover.c \
+	src/peer_auth.c \
 	src/tools/tools.c \
 	src/tools/patch.c \
 	src/tools/registry.c \
@@ -175,6 +176,7 @@ TESTS = \
 	tests/test_runtime \
 	tests/test_realm \
 	tests/test_discover \
+	tests/test_peer_auth \
 	tests/test_lowil \
 	tests/test_win_utf8 \
 	tests/test_os_dir \