[Quality][High] Add domain-separated delegation signature validation

[Baskarayelu]

Objective

Define a canonical domain-separated payload and nonce/expiry validation for delegation authorization.

Why this matters

Delegation signatures must not be reusable across contracts, networks, operations, or epochs. Ambiguous payloads create replay and parameter-substitution risk.

This is a substantive production-quality improvement. It must change runtime behavior, security guarantees, correctness, reliability, or meaningful user functionality. It is not a documentation-only, formatting-only, or trivial dependency task.

Scope

Area: delegation and signed authorization

Starting points: docs/delegation.md, docs/nonce-model.md, credence_delegation crate

The contributor should verify the current implementation before changing it and keep the PR limited to this issue. Do not introduce unrelated refactors or weaken existing CI/security gates.

Acceptance criteria

• The signed payload binds network, contract, operation, delegator, delegate, scope, nonce, and expiry.
• Stale, reused, cross-operation, and cross-contract signatures are rejected.
• Nonce consumption occurs atomically with the authorized action.
• The canonical encoding is exposed for safe client/test-vector use.

Required validation

• Add known-good vectors and mutate each signed field independently.

• Test replay across epochs, operations, and contract instances.

• Add boundary tests for expiry and nonce overflow.

• The PR explains the failure mode, the chosen design, backward-compatibility impact, and rollback or migration considerations.

• The PR includes CI evidence and does not contain secrets, generated noise, unrelated cleanup, or disabled checks.

Contributor deliverables

• Open a focused feature branch and do not begin implementation until assigned.
• Reference this issue with Closes #<issue-number> or Fixes #<issue-number>.
• Check off every acceptance criterion in the PR with links to the relevant code and tests.
• Include a security/correctness note explaining why adversarial inputs cannot bypass the new guarantee.

Maintainer quality bar

The PR must be independently reviewable, preserve existing behavior outside this scope, exercise failure paths, and pass the repository's complete required CI/CD checks. Reward eligibility is not guaranteed by this issue or by merging.