[gael-obin]

Draft: bounded installation setup calls

This candidate builds on the owner's installation receiver, preserving that branch, and adds an attempt-lifetime typed call path through Authority to exact declared unary methods. The candidate reuses Authority issuance, the SDK's transport admission, and existing relay configuration; it does not mint credentials itself.

Blocked; do not merge. Current owner instructions and the receiver's documented guarantee say the install step holds nothing and has nothing to act under. This candidate changes that guarantee. An accepted handbook proposal, explicit SDK/Authority owner agreement, independent design and implementation review, and compatibility decisions must precede adoption. The dependency chain also includes Core and Authority; current released pins do not provide the new types. The Authority trusted-host fixture path fails before callback because its consent evidence is absent. A second consumer and a real composed destination have not been proven.

This fork branch targets the owner's receiver branch at e6809f5; no push to that owner's branch is attempted. With a local uncommitted workspace selecting Core da5e9b0 and Authority c06a93c, go test ./... passed. Full CI and a real installation are unverified. The receiver PR and this draft must be reconciled if either head moves.

Latest independent review and verification

Independent architecture-bouncer review at 90c65ef blocks qualification: committed dependencies do not compile, callback credential is reachable via reflection in the supplied handle, and cancellation occurs after response writing rather than immediately at callback return. The setup mint also needs consistent owner/handbook treatment of pending installation authority. Local workspace tests do not close these findings.