ci / rust (push) Failing after 10m43s
iss/sub/aud/sid/exp claims for the broker-mediated attach flow. "Pair-scoped" means the credential identifies which home daemon (sub) may attach to which target daemon (aud) for which session (sid) — a stolen token only works between the two daemons it was issued for. Existing JwtClaims stays as a compat path; NAP-243 wires the new claims into the daemon's verifier and the registry's issuer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>