Pigeon, a signed Pass for what a sub-agent may do

Pigeon is a security framework that allows parent agents to grant narrowed, signed credentials (called "Passes") to sub-agents instead of sharing full API keys, limiting what sub-agents can access and do. Rather than requiring a server connection, Pigeon integrates directly into agent spawning and tool execution by using `delegate()` to create restricted credentials and `verify()` to enforce permissions before actions occur. This approach prevents sub-agents from accessing resources or capabilities beyond what they were explicitly granted, such as preventing a sub-agent from deploying to production when only staging deployments were authorized.