Deal-scoped PASETO: three things I got wrong about audience-bound tokens

MCP requires servers to reject tokens that were not issued for them. What audience-bound credentials cost to ship in Go, including the part I have not fixed.