lockCaller: let a leaf pin its caller onto a deferred callback #489

A leaf that stores work to run later on behalf of whoever called it (a scheduler or registry leaf) cannot make that work run as the caller. self.slothlet.lockCaller(fn) always pins the leaf that is currently running, which is the registry leaf itself.

Real case

rummage's deadline extension builds a reminder engine per consumer through self.deadline.engine(...) and ticks them all from one scheduled job. The ticks run as the deadline extension, not as each owning consumer. Owner attribution is currently carried as a payload field (owner, taken from metadata.caller()) instead of by the caller identity the rest of the system uses.

Proposal

• self.slothlet.lockCaller(fn, { as: "caller" }) pins the current leaf's caller (the identity metadata.caller() would report) onto fn instead of the leaf.
• Letting a leaf act as its caller is a privilege, so it must be gated by a permission rule (the same kind of explicit grant as metadata.caller), and it should compose with principals (feat(permissions): named, module-owned principals — async-resolved identity facts for sync conditions #459) once they land.
• The pinned identity is captured at call time and cannot be changed afterwards (same guarantees as today's lockCaller).