Carries #273 (typed CUBE_ID_INVALID for selector-form client-grant) and #130 (per-session rate limits for authenticated coordination bursts).

Reviewed at 4657d89b3bce9b046efb73ec679b0c595f334fc0 (bump, single mechanical gate) on top of c8024c87 (#130 chain: CR/SR/RQ); merge commit tree verified identical.