authz/src/mint
The @oktoid/authz/mint entry: the one function that turns an actor into a scope,
and the actor-token check that runs before it. Both are behind the lint fence that
lets only packages/messaging import this entry, so a handler can neither mint a
scope nor decide on its own that a token is good.