[chen21019]

Problem

The authenticated backend capability gate accepted only Host API 0.38.5.
The official compatible security patch 0.38.6 declares the same capability
protocol but was denied, preventing API Key streams before the handshake.
Ordinary non-Key streams do not use this gate.

Change

Accept canonical 0.38.x patch versions >=5 only when the original exact
key-audit-v1,key-delegation-v1 declaration and verified Host JWT are present.
Unknown major/minor families, malformed/prerelease/leading-zero versions,
duplicate parameters and altered capabilities remain denied. Engine authority,
live revision/expiry, durable audit failure handling and ordinary JWT behavior
are unchanged. Package version becomes 0.23.17; no existing tag is replaced.

Evidence and required checks

• The new authenticated backend registration regression fails against the old
  producer logic for 0.38.6 and passes against this candidate.
• Seven focused source tests pass locally, covering old/current patches,
  malformed declarations, forged registration, replacement connections and
  durable failure handling. Local Go was 1.27.0, not release-toolchain evidence.
• The unchanged security release workflow must separately pass Go 1.27.3 race
  tests, reproducible package comparison, reachable-symbol and product scans,
  secret scan and SBOM generation. Normal required CodeQL checks remain required.
• Server packaging and native Key stream acceptance follow the immutable
  component release; this PR does not claim native stream acceptance.

No production, HAProxy, authentication configuration or runtime patch changes.