Add default spec authority mapping

[aidankhogg]

Motivation

• Provide a helper to derive a stable set of Authority records from an existing NetEngineSpec so downstream code can consistently refer to authority surfaces by stable IDs.
• Map existing top-level spec surfaces (DNS, PKI, registries, identity, gateway, services, etc.) to canonical authority kinds/IDs used by runtime and governance logic.

Description

• Add default_authorities_for_spec(spec: NetEngineSpec) -> list[Authority] to netengine/spec/authority.py which constructs default Authority objects with stable IDs such as world-root, root-naming, numbering, domain-registry, default-registrar, trust-root, platform-identity, inworld-identity, transit-boundary, mail-authority, and service-catalog.
• Include core substrate network controls (e.g. substrate.networks.core) in the numbering authority alongside domain_registry.address_space.
• Export the new helper from netengine.spec (netengine/spec/__init__.py).
• Add unit tests in tests/test_authority_spec.py to assert stable IDs and section-to-authority control mappings.

Testing

• Ran pytest -q tests/test_spec_parsing.py tests/test_authority_spec.py and all tests passed (27 passed).
• Ran python -m mypy netengine/spec/authority.py and static type checks reported no issues.

---

Codex Task