Pigeon, a signed Pass for what a sub-agent may do

Pigeon provides signed, narrowed credentials (“Passes”) that let a parent agent delegate specific capabilities, resources, and constraints to sub-agents while preventing privilege escalation. Verification functions reject actions outside the granted scope, returning detailed denial codes such as CAPABILITY_NOT_GRANTED or RESOURCE_NOT_ALLOWED. The library includes utilities for granting, delegating, and enforcing passes without requiring a separate server.