MAS-WP-0011 finished: peer authentication in mode contract v0.1

CONTRACT.md section 7 (founder-reviewed): pairwise HMAC-SHA256 over
TIMESTAMP.BODY in MAS-Modes-* headers, 300 s window; master commands only
from the configured master; statuses only at the handoff's tokenized URL
from its peer; primed webhooks must name a known peer. mas_modes.signing,
signed contract.post, authenticating json_server, EmailMode/stubs/gateway
signing. conformance/auth.json vectors + 7 authorization flows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5787@bnt-lap001
Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd

mas_modes/schema/mas-modes-v0.1.schema.json

@@ -670,12 +670,17 @@
             {
               "type": "object",
               "required": [
-                "webhook"
+                "webhook",
+                "peer"
               ],
               "properties": {
                 "webhook": {
                   "type": "string",
                   "format": "uri"
+                },
+                "peer": {
+                  "type": "string",
+                  "minLength": 1
                 }
               },
               "additionalProperties": false