Implement real distributed worker transport and attested node identity

[hyperpolymath]

Outcome

Make Bag’s “mesh” genuinely distributed: execute on the selected owned node rather than always spawning the command on the coordinator host.

Scope

• Define a versioned transport envelope for offer, claim, lease, heartbeat, result, cancellation, and retry.
• Bind node identity and advertised capabilities to attestable keys; do not trust node names from configuration alone.
• Implement lease expiry, disconnect recovery, back-pressure, bounded retries, and duplicate-result handling.
• Ensure a node only executes work it has explicitly claimed and is authorised to perform.
• Preserve the local single-node executor as the reference fallback.
• Add multi-node integration tests with loss, delay, duplication, and malicious-message fixtures.

Acceptance criteria

• A check selected for node B demonstrably runs on node B, not the coordinator.
• Forged node identities and capability advertisements are rejected.
• Lost acknowledgements do not produce unbounded duplicate execution.
• Transport failure leaves a clear, replayable non-green state.