Task: Mint each cache partition's token in IAM

IAM loads each tenant's party cache partition with a token it mints in-process for that tenant by Token Exchange with delegation semantics: the tenant, the tenant's system party, IAM as the actor, read on parties only, a short lifetime, every issue logged.

• IAM's party cache loads each partition with that tenant's token and keeps no filter of other tenants' rows.
• A test shows a partition token names its tenant and IAM as the actor and carries only the parties read permission.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

tenant_session_service::read_inside issues the partition token in-process and shares its claim building with enter. Against the running services after a recreate, IAM logged one token per tenant for its service account, 300s, and the sign-in chooser named the ACME parties from the cache. ores.iam.core.tests pass.