Make stream correlation a first-class seam (CorrelationID)

[sigma]

Implements candidate #4 from the architecture review: name the stream-correlation requirement that auth.Wrap (and, it turns out, vterm) was smuggling through RemoteID.

Problem

auth.Wrap keyed its identity map on transport.Stream.RemoteID() — a field documented "used for log tagging; not for authentication." To satisfy this unnamed requirement, every backend overloaded RemoteID with a correlation value (websocket's per-process token, unix's SO_PEERCRED string). The interface contradicted its own contract, and each new backend had to reverse-engineer what auth needed.

Change

• Add Stream.CorrelationID(): an unauthenticated, per-dialer-instance handle that links streams to an Identity the handshake already established — it never itself grants identity. RemoteID() reverts to a pure, possibly-empty log tag.
• auth.Wrap keys on CorrelationID and fails closed on an empty handle (no aliasing under the "" key), both when storing post-handshake and when admitting app streams.
• Backends: websocket splits the token (CorrelationID) from the remote address (RemoteID); unix/libp2p/http2 expose one honest value for both roles.
• Backend correlation tests migrate from asserting RemoteID to CorrelationID; adds auth/wrap_test.go for the empty-handle guard.

Second consumer found during implementation

vterm correlated a peer's /mosey/control resize with its later /mosey/pty attach also via RemoteID. Demoting RemoteID to a per-connection tag would have silently broken that over websocket. vterm now reads CorrelationID too (internal remote→correlation rename). The review only flagged auth.Wrap; this was under-scoped.

Safety

No wire/protocol change — the websocket mosey-peer-<token> subprotocol and unix peercreds derivation are byte-identical; only where the value surfaces in Go moves. Full go build/go test ./... green.

Design record

• docs/adr/0004-stream-correlation-seam.md — granularity decision (per-dialer, not per-connection or per-identity), the link-not-grant contract, the fail-closed rule, per-backend unforgeability bar, and deferred known-limits (identity-map eviction, unix pid-reuse).
• CONTEXT.md — new Transport glossary section (Stream, CorrelationID, RemoteID).

Produced via a /grill-with-docs session.

Notes for the reviewer

• This branch is off origin/main (83876a5). CONTEXT.md and docs/adr/ do not yet exist upstream — they are being introduced by the parallel /grill-with-docs sessions. This PR's CONTEXT.md therefore also carries candidate refactor(walletsolana): keyless Source construction; export RPC caller seam #1's Capabilities/Auth sections (uncommitted elsewhere); only the Transport section and ADR 0004 are this PR's subject. ADR numbering was bumped 0002→0004 to avoid collision with the concurrent signing-session (0002) and moseynet (0003) sessions.