Spark resource extension for explicit idempotency and one-time nonce protection.

A protected action must choose a strategy and a nonempty scope. Nonce protection has no stored-response or external-effect surface and always fails closed.

Nonce window separates acceptance (max_age) from optional claim retention (retain_for, defaulting to max_age). Retention must be at least the acceptance duration; both include clock_skew under the same bounded duration rule.