Mandate APIs

Repository-owned machine contracts, rendered from the exact source revision in the Website source lock.

• authorization
• control-plane
• sts
• worker