Decentralized snapshot distribution: Identity trust via UCAN delegation

## Summary

Add cryptographic identity trust to the decentralized snapshot distribution flow using UCAN (User Controlled Authorization Networks) delegation chains, eliminating the honest-majority assumption without introducing a central runtime dependency.

## Background

Statistical trust (step 2) defends against isolated bad actors but not coordinated Sybil attacks. UCAN adds an identity layer: known trusted publishers sign their preverified.toml updates, and nodes verify the delegation chain locally.

## Design

### UCAN Delegation Model

- **Root authority**: A key embedded in the binary (similar to how JWT secrets work today). Controls publishing rights for a chain's snapshots.
- **Delegation**: Root authority issues UCAN tokens to trusted snapshot publishers, granting them the right to publish info-hashes for a specific chain. Delegations are created via a CLI tool.
- **Verification**: Nodes verify the full delegation chain: root authority → publisher → info-hash. Verification is purely local — no central server needed at runtime.
- **Revocation**: Initially rely on token expiry. Explicit revocation can be added later.
- **Scope**: Separate delegations per chain (mainnet, sepolia, etc.)

### Node Identity Integration

- UCAN uses DIDs (Decentralized Identifiers). Node secp256k1 keys are compatible via `did:key` method.
- Publishers sign their preverified.toml info-hash with their node key.
- UCAN token + signature distributed via discv5 TALK protocol (too large for ENR's 300-byte limit).

### Flow

```
Publisher node:
1. Has UCAN token delegated from root authority
2. Creates preverified.toml, computes info-hash
3. Signs info-hash with node key
4. Publishes ENR entry (FrozenTx + InfoHash) as before
5. Serves UCAN token + signature via TALK protocol on request

Verifying node:
1. Discovers peer with higher FrozenTx via ENR
2. Requests UCAN token via TALK protocol
3. Verifies delegation chain: root key → publisher DID → info-hash signature
4. If valid, downloads preverified.toml via BitTorrent
5. If invalid, ignores peer and continues searching
```

### Libraries

- [github.com/ucan-wg/go-ucan](https://github.com/ucan-wg/go-ucan) — UCAN token creation/verification
- `did:key` with secp256k1 via existing node identity keys

### Key Properties

- **No central runtime dependency**: Root key is embedded, verification is local
- **Trustless**: Only nodes with a valid delegation chain can publish
- **Defeats Sybil attacks**: Publishing rights are cryptographically scoped
- **Composable**: Works on top of the ENR + BitTorrent infrastructure from step 1

## Acceptance Criteria

- [ ] UCAN token creation via CLI tool (root key → publisher delegation)
- [ ] TALK protocol handler registered for UCAN token exchange
- [ ] UCAN verification integrated into discovery flow
- [ ] Root authority key embedded in binary per chain
- [ ] Invalid/expired delegations rejected
- [ ] Existing flow (steps 1-2) continues to work without UCAN configured