v0.22.0 — proxy-proof resolver

Adds VGI_PROXY_PROOF_* handling to the worker's env-driven auth resolution, so a worker can refuse any request that did not arrive through a trusted proxy.

env var	meaning
VGI_PROXY_PROOF_MODE	off (default), allow, require
VGI_PROXY_PROOF_ORIGIN_ID	this worker's identifier — folded into every MAC but never transmitted
VGI_PROXY_PROOF_SECRETS	kid:hex pairs; the kid doubles as the calling proxy's label
VGI_PROXY_PROOF_SKEW	acceptance half-window, default 30s

The gate is composed with require_all(), not chained: chaining is first-success-wins, so a gate in a chain would be satisfied by whichever credential came next — precisely the bypass it exists to close.

Malformed configuration aborts startup rather than degrading to off. The secret is shared with an independently-deployed proxy, so a typo would otherwise silently derive a different key on each side and turn require into a total rejection outage with nothing pointing at the cause.

Floor moved to vgi-rpc>=0.28.2.