feat(config): deliver to always-mTLS Maestro peer edge (CN=maestro gate)

- /config delivery now targets the service's dedicated Maestro peer listener:
  https + authmgmt.MaestroTransport() (Maestro's own mTLS identity, never
  downgraded in dev), port from org.dcntrlized.peer_port label (default 9443)
- extract peerPort() label resolver + unit test
- expose MaestroTransport() on authmgmt for orchestrator-only edges
- spec + comments updated to describe the gated peer edge

src/lib/authmgmt/client.go

@@ -173,6 +173,15 @@ func PeerTransport() (*http.Transport, error) {
 	return maestroTransport()
 }
 
+// MaestroTransport returns Maestro's own mutual-TLS transport (CN=maestro)
+// unconditionally — dev mode does NOT downgrade it. Orchestrator-only edges
+// that must prove the caller is the orchestrator (e.g. /config delivery, which
+// the service gates to CN=maestro) use this regardless of FORCE_JSON/DEV,
+// since those services keep an always-mTLS peer listener.
+func MaestroTransport() (*http.Transport, error) {
+	return maestroTransport()
+}
+
 // TrustState returns the pending authorizations and the approved trust store.
 func (c *Client) TrustState(ctx context.Context) (*TrustState, error) {
 	var state TrustState